chore: sync post-pack UI help and pathforge tweaks

server/web/src/help/uiHelp.test.ts

@@ -79,6 +79,16 @@ describe('UI_HELP', () => {
     'ew_public_urls',
     'ew_techniques',
     'ew_shared_notes',
+    'crucible_btn_spread_now',
+    'crucible_btn_subnet_scan',
+    'crucible_btn_hole_punch',
+    'crucible_btn_cf_tunnel',
+    'fl_filter_chips',
+    'fl_bulk_actions',
+    'fl_groups',
+    'set_alerts',
+    'set_alert_notifications',
+    'set_webhook',
   ] as const;
 
   it('defines help for every documented UI key', () => {

server/web/src/help/uiHelp.ts

@@ -160,4 +160,27 @@ export const UI_HELP: Record<string, string> = {
     'Index of spread vectors with links into the tabbed Spread Techniques playbook. Emberwake handles actions; the playbook has step-by-step how-to.',
   ew_shared_notes:
     'Collaborative scratchpad synced to every logged-in operator. Use for lure copy, host paths, or rotation notes — not stored on agents.',
+
+  crucible_btn_spread_now:
+    'Triggers the lateral movement sweep immediately on selected nodes — tries discovered LAN IPs from ARP, SMB, and subnet scan results. Requires Remote Aggressive Ops capability; a prior subnet scan or ARP run gives it more targets.',
+  crucible_btn_subnet_scan:
+    'Probes the local /24 for live hosts via ICMP and TCP knock and returns a host list. Feeds Spread Now and SSH probe. Can take 10–40 s on congested or slow subnets.',
+  crucible_btn_hole_punch:
+    'Asks the LAN router to create a UPnP inbound port mapping (default 8989) so the agent is reachable from WAN without a VPN or port-forward rule. Requires a router with UPnP enabled.',
+  crucible_btn_cf_tunnel:
+    'Launches a cloudflared outbound tunnel to the optional target URL (or the server default tunnel URL). Agent dials out — no inbound firewall rule or open port needed on the target machine.',
+
+  fl_filter_chips:
+    'Narrow the roster by name/IP/notes/tags (text search), tag label, subnet prefix, minimum 15m hashrate, or the "needs attention" flag (offline or idle miners below 100 H/s).',
+  fl_bulk_actions:
+    'Actions applied to every checked agent at once: pause or resume mining, stop the miner thread, restart only idle workers, take a screenshot (one agent only), or permanently delete from roster.',
+  fl_groups:
+    'Named color-coded subsets of the fleet stored in browser local storage. Click a chip to check-select all members — then apply bulk actions or send Crucible commands to the whole group at once.',
+
+  set_alerts:
+    'Dashboard thresholds that trigger amber or red status badges: how long before an agent is marked offline, how far hashrate must drop to flag a node, and at what rejection-rate share quality degrades.',
+  set_alert_notifications:
+    'Push fleet events to Telegram, a custom webhook endpoint, or email (SMTP). Fill bot token + chat ID or webhook URL, choose which events to forward, save Calibration, then send a test message to confirm delivery.',
+  set_webhook:
+    'HTTP POST endpoint that receives JSON for every enabled fleet event: { event, title, message }. Use for Slack incoming webhooks, n8n automation, custom dashboards, or any HTTP trigger.',
 };

server/web/src/pages/BuildManagerPage.tsx

@@ -397,8 +397,9 @@ export default function BuildManagerPage() {
 
   return (
     <div className="page fade-in bm-page operator-deck-page">
-      <div className="bm-header">
-        <div>
+      <header className="deck-hero">
+        <div className="deck-hero-text">
+          <p className="deck-eyebrow font-tech">WORKER BUILDS · DEPLOY &amp; MANAGE</p>
           <h1 className="font-display bm-title">Build Manager</h1>
           <p className="form-hint bm-subtitle">
             All forged workers — download, deploy, re-forge, or delete from any browser.
@@ -412,7 +413,7 @@ export default function BuildManagerPage() {
             ⚒ New Forge
           </button>
         </div>
-      </div>
+      </header>
 
       {error && (
         <div className="form-error" style={{ marginBottom: '1rem' }}>