Add by-design safety tests and clear PROBLEMS.md rows.

Go/Vitest coverage for bof_execute, hollow AMSI limits, cloudflared stub policy, KEV n/a, mesh P2P zero peers, and non-Windows GPU/camera stubs. Skip GPU subprocess on non-Windows; document cloudflared external connector path.

agent/client/camera_platform_stub_test.go

@@ -0,0 +1,27 @@
+//go:build !windows && !linux
+
+package client
+
+import "testing"
+
+func TestCameraStubUnsupportedOnDarwinAndOtherUnix(t *testing.T) {
+	for _, action := range []string{"camera_snapshot", "camera_list"} {
+		handled, success, msg := handleCameraAction(action, "")
+		if !handled {
+			t.Fatalf("%s not handled by platform stub", action)
+		}
+		if success {
+			t.Fatalf("%s must fail on non-Windows/non-Linux platforms", action)
+		}
+		if msg == "" {
+			t.Fatalf("%s returned empty message", action)
+		}
+	}
+}
+
+func TestCameraStubIgnoresUnknownActions(t *testing.T) {
+	handled, _, _ := handleCameraAction("screenshot", "")
+	if handled {
+		t.Fatal("screenshot should not be handled by camera stub")
+	}
+}