Add by-design safety tests and clear PROBLEMS.md rows.

Go/Vitest coverage for bof_execute, hollow AMSI limits, cloudflared stub policy, KEV n/a, mesh P2P zero peers, and non-Windows GPU/camera stubs. Skip GPU subprocess on non-Windows; document cloudflared external connector path.

agent/deploy/hollow_design.go

@@ -0,0 +1,9 @@
+package deploy
+
+// Intentional process-hollowing limits (see hollow_windows.go RunHollowed).
+// Relocation patching is implemented; AMSI/ETW bypass is not — Defender may
+// still block ~50% of real-world attempts on Windows 10/11.
+const (
+	HollowRelocationsImplemented = true
+	HollowAMSIBypassImplemented  = false
+)