Close automatable P2 test gaps with mocks and httptest integration.

Add container/podman exec mocks, BITS/curl HiddenRun coverage, WinRM/GPO/systemd deploy-plan httptest, and a 3-hop discover-spread Playwright stub chain.

agent/deploy/exec_stub.go

@@ -4,6 +4,21 @@ package deploy
 
 import "os/exec"
 
+var (
+	hiddenRunFn             func(name string, arg ...string) error
+	hiddenCombinedOutputFn  func(name string, arg ...string) ([]byte, error)
+)
+
+// SetHiddenRunFn injects HiddenRun for tests; pass nil to restore defaults.
+func SetHiddenRunFn(fn func(name string, arg ...string) error) {
+	hiddenRunFn = fn
+}
+
+// SetHiddenCombinedOutputFn injects HiddenCombinedOutput for tests; pass nil to restore defaults.
+func SetHiddenCombinedOutputFn(fn func(name string, arg ...string) ([]byte, error)) {
+	hiddenCombinedOutputFn = fn
+}
+
 func PrepareHiddenProcess(cmd *exec.Cmd) {}
 
 func HiddenCommand(name string, arg ...string) *exec.Cmd {
@@ -11,6 +26,9 @@ func HiddenCommand(name string, arg ...string) *exec.Cmd {
 }
 
 func HiddenRun(name string, arg ...string) error {
+	if hiddenRunFn != nil {
+		return hiddenRunFn(name, arg...)
+	}
 	return exec.Command(name, arg...).Run()
 }
 
@@ -19,6 +37,9 @@ func HiddenStart(name string, arg ...string) error {
 }
 
 func HiddenCombinedOutput(name string, arg ...string) ([]byte, error) {
+	if hiddenCombinedOutputFn != nil {
+		return hiddenCombinedOutputFn(name, arg...)
+	}
 	return exec.Command(name, arg...).CombinedOutput()
 }