fix: 2026-06-04 audit pass — README, USB pack, multi-area fixes

WS ticket dashboard auth, builder universal signing/size limits/fusion obfuscation/dropper bundles, Path Tracer WireGuard topology, SessionGate degraded mode and download timeouts, server bootstrap (data dir, cloudflared dedupe, config port precedence), agent mesh/miner/spread fixes. README refreshed; usb bundle repacked; PROBLEMS.md audit log updated.

server/internal/builder/sign_windows.go

@@ -11,11 +11,32 @@ import (
 	"strings"
 )
 
+func signingToolMissingNote() string {
+	return "Code signing requested but signtool is not installed — install Windows SDK or set sign_tool_path in Calibrate."
+}
+
+func (h *Handler) signingToolAvailable() bool {
+	if tool := strings.TrimSpace(h.policy.Sign.ToolPath); tool != "" {
+		if _, err := os.Stat(tool); err == nil {
+			return true
+		}
+	}
+	_, err := findSignTool()
+	return err == nil
+}
+
 func (h *Handler) shouldSignBuild(req *BuildRequest) bool {
 	if !h.policy.Sign.Enabled || strings.TrimSpace(h.policy.Sign.CertThumbprint) == "" {
 		return false
 	}
-	return req.SignBuild
+	if !req.SignBuild {
+		return false
+	}
+	if _, err := findSignTool(); err != nil {
+		log.Printf("[Forge] sign requested but signtool not found — install Windows SDK or set sign_tool_path in Calibrate")
+		return false
+	}
+	return true
 }
 
 func (h *Handler) signExecutable(path string) error {