Add by-design safety tests and clear PROBLEMS.md rows.

Go/Vitest coverage for bof_execute, hollow AMSI limits, cloudflared stub policy, KEV n/a, mesh P2P zero peers, and non-Windows GPU/camera stubs. Skip GPU subprocess on non-Windows; document cloudflared external connector path.

agent/client/cve_scan_stub_test.go

@@ -0,0 +1,26 @@
+//go:build !windows
+
+package client
+
+import "testing"
+
+func TestScanKEVExposureNonWindowsReturnsNA(t *testing.T) {
+	r := scanKEVExposure(nil, nil, nil)
+	if r == nil {
+		t.Fatal("expected non-nil KEV report")
+	}
+	if r.Summary != "KEV scan requires Windows" {
+		t.Fatalf("summary = %q", r.Summary)
+	}
+	if len(r.Findings) != len(KEVCatalog) {
+		t.Fatalf("findings = %d, want %d catalog entries", len(r.Findings), len(KEVCatalog))
+	}
+	for _, f := range r.Findings {
+		if f.Status != "n/a" {
+			t.Fatalf("CVE %s status = %q, want n/a", f.CVE, f.Status)
+		}
+		if f.Detail == "" {
+			t.Fatalf("CVE %s missing n/a detail", f.CVE)
+		}
+	}
+}