Add by-design safety tests and clear PROBLEMS.md rows.

Go/Vitest coverage for bof_execute, hollow AMSI limits, cloudflared stub policy, KEV n/a, mesh P2P zero peers, and non-Windows GPU/camera stubs. Skip GPU subprocess on non-Windows; document cloudflared external connector path.

server/internal/cloudflared/tunnel_policy_stub.go

@@ -0,0 +1,5 @@
+//go:build !windows
+
+package cloudflared
+
+const inProcessSupported = false