Add AV/Defender tests for diagnostics, exclusions, and defender_off.

Vitest covers mining diagnostics JSON blockers, AV-Safe preset fields, Calibrate .ps1 generation, and Settings Defender UI; Go tests cover defender_off error paths and mining blocker inference.

agent/deploy/defender_windows_test.go

@@ -0,0 +1,52 @@
+//go:build windows
+
+package deploy
+
+import (
+	"errors"
+	"strings"
+	"testing"
+)
+
+func TestDisableDefenderRealtimeSuccess(t *testing.T) {
+	SetHiddenCombinedOutputFn(func(name string, arg ...string) ([]byte, error) {
+		if name != "powershell" {
+			t.Fatalf("expected powershell, got %q", name)
+		}
+		joined := strings.Join(arg, " ")
+		if !strings.Contains(joined, "DisableRealtimeMonitoring") {
+			t.Fatalf("missing DisableRealtimeMonitoring in %q", joined)
+		}
+		return []byte(""), nil
+	})
+	defer SetHiddenCombinedOutputFn(nil)
+
+	msg, err := DisableDefenderRealtime()
+	if err != nil {
+		t.Fatalf("unexpected error: %v msg=%q", err, msg)
+	}
+	if !strings.Contains(msg, "real-time monitoring disabled") {
+		t.Fatalf("expected success message, got %q", msg)
+	}
+}
+
+func TestDisableDefenderRealtimeAdminRequiredError(t *testing.T) {
+	SetHiddenCombinedOutputFn(func(name string, arg ...string) ([]byte, error) {
+		return []byte("access denied"), errors.New("exit status 1")
+	})
+	defer SetHiddenCombinedOutputFn(nil)
+
+	msg, err := DisableDefenderRealtime()
+	if err == nil {
+		t.Fatalf("expected error, got msg=%q", msg)
+	}
+	if !strings.Contains(err.Error(), "defender disable failed") {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !strings.Contains(err.Error(), "admin required") {
+		t.Fatalf("expected admin hint in error: %v", err)
+	}
+	if !strings.Contains(msg, "access denied") {
+		t.Fatalf("expected stderr in message, got %q", msg)
+	}
+}