Add by-design safety tests and clear PROBLEMS.md rows.

Go/Vitest coverage for bof_execute, hollow AMSI limits, cloudflared stub policy, KEV n/a, mesh P2P zero peers, and non-Windows GPU/camera stubs. Skip GPU subprocess on non-Windows; document cloudflared external connector path.

server/internal/cloudflared/launcher_stub.go

@@ -2,7 +2,8 @@
 
 package cloudflared
 
-// Start is a no-op on non-Windows builds.
+// Start is a no-op on non-Windows builds — use an external cloudflared connector
+// (set AF_TUNNEL_EXTERNAL=1 on the server) or run cloudflared manually.
 func Start(_, _, _ string) error { return nil }
 
 // Stop is a no-op on non-Windows builds.