Add by-design safety tests and clear PROBLEMS.md rows.

Go/Vitest coverage for bof_execute, hollow AMSI limits, cloudflared stub policy, KEV n/a, mesh P2P zero peers, and non-Windows GPU/camera stubs. Skip GPU subprocess on non-Windows; document cloudflared external connector path.

server/internal/cloudflared/tunnel_policy.go

@@ -0,0 +1,14 @@
+package cloudflared
+
+import "strings"
+
+// InProcessSupported reports whether this build can spawn cloudflared in-process.
+func InProcessSupported() bool {
+	return inProcessSupported
+}
+
+// ShouldStartInProcess returns true when the server should launch cloudflared itself.
+// Set AF_TUNNEL_EXTERNAL=1 when an external connector (e.g. LAUNCH.bat) already owns the tunnel.
+func ShouldStartInProcess(tunnelExternal bool, token string) bool {
+	return strings.TrimSpace(token) != "" && !tunnelExternal
+}