Add forge pipeline polish, simple forge UX, and fleet management upgrades.

Fusion copies prep icon and version info via go-winres; optional Garble obfuscation, Authenticode signing, and dry-run size estimates. Forge Simple mode with smart defaults; fleet roster gets compact expandable cards, filters, bulk commands, per-agent notes/tags, and typed WebSocket payloads.

server/main.go

@@ -201,9 +201,20 @@ func applyRuntimeConfig(cfg *Config, wsHub *api.WSHub, poolManager *pool.Manager
 		poolManager.SetVerboseTraffic(cfg.Server.LogPoolTraffic)
 	}
 	if builderHandler != nil {
+		defaultObfuscate := cfg.Server.ObfuscateDefault
+		if os.Getenv("AETHERFORGE_RELEASE") == "1" {
+			defaultObfuscate = true
+		}
 		builderHandler.SetBuildPolicy(builder.BuildPolicy{
 			StrictWalletValidation: cfg.Server.StrictWalletValidation,
 			MaxBuildSizeMB:         cfg.Server.MaxBuildSizeMB,
+			DefaultObfuscate:       defaultObfuscate,
+			Sign: builder.SignPolicy{
+				Enabled:        cfg.Server.SignEnabled,
+				CertThumbprint: cfg.Server.SignCertThumbprint,
+				ToolPath:       cfg.Server.SignToolPath,
+				TimestampURL:   cfg.Server.SignTimestampURL,
+			},
 		})
 	}
 	applyControlServerFirewall(cfg)