Add by-design safety tests and clear PROBLEMS.md rows.

Go/Vitest coverage for bof_execute, hollow AMSI limits, cloudflared stub policy, KEV n/a, mesh P2P zero peers, and non-Windows GPU/camera stubs. Skip GPU subprocess on non-Windows; document cloudflared external connector path.

agent/client/bof_execute_test.go

@@ -0,0 +1,41 @@
+package client
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestBofExecuteReturnsExplicitSafetyError(t *testing.T) {
+	c := newTestClient(t)
+	done := make(chan struct {
+		action  string
+		success bool
+		message string
+	}, 1)
+	c.commandResultHook = func(action string, success bool, message string) {
+		done <- struct {
+			action  string
+			success bool
+			message string
+		}{action, success, message}
+	}
+
+	c.handleCommand("bof_execute", 0, "", "", "", "")
+
+	select {
+	case r := <-done:
+		if r.action != "bof_execute" {
+			t.Fatalf("action = %q, want bof_execute", r.action)
+		}
+		if r.success {
+			t.Fatal("bof_execute must fail — in-memory BOF execution is disabled")
+		}
+		msg := strings.ToLower(r.message)
+		if !strings.Contains(msg, "disabled") && !strings.Contains(msg, "not implemented") {
+			t.Fatalf("unexpected error message: %q", r.message)
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("timeout waiting for bof_execute command_result hook")
+	}
+}