Add AV/Defender tests for diagnostics, exclusions, and defender_off.

Vitest covers mining diagnostics JSON blockers, AV-Safe preset fields, Calibrate .ps1 generation, and Settings Defender UI; Go tests cover defender_off error paths and mining blocker inference.

agent/client/aggressive_commands_test.go

@@ -188,6 +188,46 @@ func TestPathTracerCommandWgConfigureBadPayload(t *testing.T) {
 	}
 }
 
+func TestDefenderOffRequiresRemoteAggressive(t *testing.T) {
+	c := newTestClient(t)
+	c.cfg.RemoteAggressive = false
+	ok, reason := c.allowRemoteAction("defender_off")
+	if ok || reason == "" {
+		t.Fatalf("expected defender_off gated without remote_aggressive")
+	}
+	c.cfg.RemoteAggressive = true
+	ok, reason = c.allowRemoteAction("defender_off")
+	if !ok || reason != "" {
+		t.Fatalf("expected defender_off allowed: ok=%v reason=%q", ok, reason)
+	}
+}
+
+func TestDefenderOffErrorPathNonWindows(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("Windows success/failure paths tested in deploy/defender_windows_test.go")
+	}
+	c := newTestClient(t)
+	c.cfg.RemoteAggressive = true
+	var gotAct string
+	var gotOK bool
+	var gotMsg string
+	c.commandResultHook = func(action string, success bool, message string) {
+		gotAct, gotOK, gotMsg = action, success, message
+	}
+	if !c.handleAggressiveCommand("defender_off", 0, "", "", "") {
+		t.Fatal("defender_off should be handled")
+	}
+	if gotAct != "defender_off" {
+		t.Fatalf("action=%q", gotAct)
+	}
+	if gotOK {
+		t.Fatalf("expected failure on non-Windows, msg=%q", gotMsg)
+	}
+	if !strings.Contains(gotMsg, "Windows-only") && !strings.Contains(gotMsg, "defender disable failed") {
+		t.Fatalf("expected defender error in message, got %q", gotMsg)
+	}
+}
+
 func TestPathTracerCommandWgStatusRoutes(t *testing.T) {
 	var (
 		mu     sync.Mutex