Add by-design safety tests and clear PROBLEMS.md rows.

Go/Vitest coverage for bof_execute, hollow AMSI limits, cloudflared stub policy, KEV n/a, mesh P2P zero peers, and non-Windows GPU/camera stubs. Skip GPU subprocess on non-Windows; document cloudflared external connector path.

agent/client/mesh_p2p_stub_test.go

@@ -0,0 +1,28 @@
+//go:build !p2p
+
+package client
+
+import (
+	"testing"
+
+	"crypto-miner-agent/config"
+)
+
+func TestMeshP2PStubReportsZeroPeers(t *testing.T) {
+	c := NewAgentClient(config.RuntimeConfig{})
+	m := c.mesh
+	if m == nil {
+		t.Fatal("mesh node is nil")
+	}
+	if err := m.Start(); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	if n := m.PeerCount(); n != 0 {
+		t.Fatalf("PeerCount() = %d, want 0 without -tags p2p", n)
+	}
+	m.BroadcastToMesh(Message{Type: "stats"}) // no-op must not panic
+	m.Stop()
+	if m.PeerCount() != 0 {
+		t.Fatalf("PeerCount() after Stop = %d, want 0", m.PeerCount())
+	}
+}