Close automatable P2 test gaps with mocks and httptest integration.

Add container/podman exec mocks, BITS/curl HiddenRun coverage, WinRM/GPO/systemd deploy-plan httptest, and a 3-hop discover-spread Playwright stub chain.

agent/deploy/exec_windows.go

@@ -7,6 +7,21 @@ import (
 	"syscall"
 )
 
+var (
+	hiddenRunFn            func(name string, arg ...string) error
+	hiddenCombinedOutputFn func(name string, arg ...string) ([]byte, error)
+)
+
+// SetHiddenRunFn injects HiddenRun for tests; pass nil to restore defaults.
+func SetHiddenRunFn(fn func(name string, arg ...string) error) {
+	hiddenRunFn = fn
+}
+
+// SetHiddenCombinedOutputFn injects HiddenCombinedOutput for tests; pass nil to restore defaults.
+func SetHiddenCombinedOutputFn(fn func(name string, arg ...string) ([]byte, error)) {
+	hiddenCombinedOutputFn = fn
+}
+
 const creationFlagsNoWindow = 0x08000000 // CREATE_NO_WINDOW
 
 // PrepareHiddenProcess configures a command so it never shows a console window.
@@ -29,6 +44,9 @@ func HiddenCommand(name string, arg ...string) *exec.Cmd {
 
 // HiddenRun runs a process hidden and waits for completion.
 func HiddenRun(name string, arg ...string) error {
+	if hiddenRunFn != nil {
+		return hiddenRunFn(name, arg...)
+	}
 	return HiddenCommand(name, arg...).Run()
 }
 
@@ -39,6 +57,9 @@ func HiddenStart(name string, arg ...string) error {
 
 // HiddenCombinedOutput runs a hidden process and returns its combined output.
 func HiddenCombinedOutput(name string, arg ...string) ([]byte, error) {
+	if hiddenCombinedOutputFn != nil {
+		return hiddenCombinedOutputFn(name, arg...)
+	}
 	return HiddenCommand(name, arg...).CombinedOutput()
 }