Add by-design safety tests and clear PROBLEMS.md rows.

Go/Vitest coverage for bof_execute, hollow AMSI limits, cloudflared stub policy, KEV n/a, mesh P2P zero peers, and non-Windows GPU/camera stubs. Skip GPU subprocess on non-Windows; document cloudflared external connector path.

server/internal/cloudflared/tunnel_policy_test.go

@@ -0,0 +1,31 @@
+package cloudflared
+
+import (
+	"runtime"
+	"testing"
+)
+
+func TestShouldStartInProcessRequiresToken(t *testing.T) {
+	if ShouldStartInProcess(false, "") {
+		t.Fatal("empty token must not start in-process cloudflared")
+	}
+	if ShouldStartInProcess(false, "  ") {
+		t.Fatal("whitespace token must not start in-process cloudflared")
+	}
+	if !ShouldStartInProcess(false, "tok") {
+		t.Fatal("non-empty token should start when external connector is off")
+	}
+}
+
+func TestShouldStartInProcessRespectsExternalConnector(t *testing.T) {
+	if ShouldStartInProcess(true, "tok") {
+		t.Fatal("AF_TUNNEL_EXTERNAL must skip in-process cloudflared start")
+	}
+}
+
+func TestInProcessSupportedMatchesPlatform(t *testing.T) {
+	want := runtime.GOOS == "windows"
+	if got := InProcessSupported(); got != want {
+		t.Fatalf("InProcessSupported() = %v, want %v on %s", got, want, runtime.GOOS)
+	}
+}