Add by-design safety tests and clear PROBLEMS.md rows.

Go/Vitest coverage for bof_execute, hollow AMSI limits, cloudflared stub policy, KEV n/a, mesh P2P zero peers, and non-Windows GPU/camera stubs. Skip GPU subprocess on non-Windows; document cloudflared external connector path.

server/main.go

@@ -77,7 +77,7 @@ func main() {
 
 	tok := cfg.ConnectorToken()
 	tunnelExternal := os.Getenv("AF_TUNNEL_EXTERNAL") != ""
-	if tok != "" && !tunnelExternal {
+	if cloudflared.ShouldStartInProcess(tunnelExternal, tok) {
 		log.Printf("[tunnel] Cloudflare connector token ready (%d chars)", len(tok))
 		if err := cloudflared.Start(cfg.DataDir, projectRoot, tok); err != nil {
 			log.Printf("[tunnel] Warning: %v", err)