fix: 2026-06-04 audit pass — README, USB pack, multi-area fixes

WS ticket dashboard auth, builder universal signing/size limits/fusion obfuscation/dropper bundles, Path Tracer WireGuard topology, SessionGate degraded mode and download timeouts, server bootstrap (data dir, cloudflared dedupe, config port precedence), agent mesh/miner/spread fixes. README refreshed; usb bundle repacked; PROBLEMS.md audit log updated.

server/internal/builder/winres_test.go

@@ -0,0 +1,29 @@
+package builder
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+)
+
+func TestResolveToolPathsBundledGarble(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("bundled garble probe uses .exe suffix on Windows")
+	}
+	root := t.TempDir()
+	binDir := filepath.Join(root, "toolchain", "gopath", "bin")
+	if err := os.MkdirAll(binDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	garblePath := filepath.Join(binDir, "garble")
+	if err := os.WriteFile(garblePath, []byte("#!/bin/sh\n"), 0755); err != nil {
+		t.Fatal(err)
+	}
+
+	h := &Handler{projectRoot: root}
+	h.resolveToolPaths(root)
+	if h.garblePath != garblePath {
+		t.Fatalf("expected bundled garble %q, got %q", garblePath, h.garblePath)
+	}
+}