Add by-design safety tests and clear PROBLEMS.md rows.

Go/Vitest coverage for bof_execute, hollow AMSI limits, cloudflared stub policy, KEV n/a, mesh P2P zero peers, and non-Windows GPU/camera stubs. Skip GPU subprocess on non-Windows; document cloudflared external connector path.

agent/deploy/hollow_test.go

@@ -16,3 +16,12 @@ func TestRunHollowedUnavailableWithoutTag(t *testing.T) {
 	}
 }
 
+func TestHollowDesignLimitsDocumented(t *testing.T) {
+	if !HollowRelocationsImplemented {
+		t.Fatal("relocation patching must remain implemented (H12)")
+	}
+	if HollowAMSIBypassImplemented {
+		t.Fatal("AMSI/ETW bypass must stay disabled by design")
+	}
+}
+