Add forge pipeline polish, simple forge UX, and fleet management upgrades.

Fusion copies prep icon and version info via go-winres; optional Garble obfuscation, Authenticode signing, and dry-run size estimates. Forge Simple mode with smart defaults; fleet roster gets compact expandable cards, filters, bulk commands, per-agent notes/tags, and typed WebSocket payloads.

server/internal/builder/sign_stub.go

@@ -0,0 +1,13 @@
+//go:build !windows
+
+package builder
+
+import "fmt"
+
+func (h *Handler) shouldSignBuild(req *BuildRequest) bool {
+	return false
+}
+
+func (h *Handler) signExecutable(path string) error {
+	return fmt.Errorf("code signing requires building on Windows")
+}