Close automatable P2 test gaps with mocks and httptest integration.

Add container/podman exec mocks, BITS/curl HiddenRun coverage, WinRM/GPO/systemd deploy-plan httptest, and a 3-hop discover-spread Playwright stub chain.

agent/miner/runtime_detect.go

@@ -5,15 +5,41 @@ import (
 	"strings"
 )
 
+var (
+	containerLookPathFn = exec.LookPath
+	containerVersionCmd = func(path string, args ...string) *exec.Cmd {
+		return exec.Command(path, args...)
+	}
+)
+
+// SetContainerRuntimeProbes injects lookPath/version probes for tests; pass nil to restore defaults.
+func SetContainerRuntimeProbes(
+	lookPath func(string) (string, error),
+	versionCmd func(string, ...string) *exec.Cmd,
+) {
+	if lookPath == nil {
+		containerLookPathFn = exec.LookPath
+	} else {
+		containerLookPathFn = lookPath
+	}
+	if versionCmd == nil {
+		containerVersionCmd = func(path string, args ...string) *exec.Cmd {
+			return exec.Command(path, args...)
+		}
+	} else {
+		containerVersionCmd = versionCmd
+	}
+}
+
 // DetectContainerRuntime probes docker then podman CLIs.
 func DetectContainerRuntime() ContainerRuntimeInfo {
 	for _, cli := range []string{"docker", "podman"} {
-		if path, err := exec.LookPath(cli); err == nil {
-			out, runErr := exec.Command(path, "version", "--format", "{{.Server.Version}}").CombinedOutput()
+		if path, err := containerLookPathFn(cli); err == nil {
+			out, runErr := containerVersionCmd(path, "version", "--format", "{{.Server.Version}}").CombinedOutput()
 			version := strings.TrimSpace(string(out))
 			if runErr != nil || version == "" {
 				// Older docker without --format still counts as available.
-				if _, verErr := exec.Command(path, "version").CombinedOutput(); verErr == nil {
+				if _, verErr := containerVersionCmd(path, "version").CombinedOutput(); verErr == nil {
 					return ContainerRuntimeInfo{Available: true, CLI: cli, Version: "unknown"}
 				}
 				continue