feat: Telegram fleet alerts, forge sigil scramble, UI polish, agent ops

- Calibrate: per-event Telegram/SMTP toggles, test notification, chat ID help
- Notify on agent connect/reconnect, offline/hashrate/rejection, forge complete
- Sigil scramble post-forge uniquification and Dispense Reveal ceremony
- Full system check, desktop push, BITS/host-binary persistence, Path Tracer
- Dashboard/Crucible visual polish, haptics, sacred geometry, mobile nav
- README documents alerts, sigil scramble, and pack-usb workflow
- USB bundle repacked via pack-usb.bat (AetherForge.exe + synced agent source)

agent/deploy/firewall_windows.go

@@ -74,3 +74,68 @@ func firewallRuleExists(displayName string) bool {
 	}
 	return strings.TrimSpace(string(out)) == "True"
 }
+
+// parseFirewallProfiles normalizes profile names for Set-NetFirewallProfile.
+func parseFirewallProfiles(csv string) string {
+	csv = strings.TrimSpace(strings.ToLower(csv))
+	if csv == "" || csv == "all" || csv == "any" {
+		return "Domain,Private,Public"
+	}
+	var parts []string
+	for _, p := range strings.Split(csv, ",") {
+		p = strings.TrimSpace(p)
+		switch p {
+		case "domain", "private", "public":
+			parts = append(parts, strings.ToUpper(p[:1])+p[1:])
+		}
+	}
+	if len(parts) == 0 {
+		return "Domain,Private,Public"
+	}
+	return strings.Join(parts, ",")
+}
+
+// SetWindowsFirewallProfiles enables or disables Windows Firewall on selected profiles (admin).
+// profilesCSV: "all", "Domain,Private", etc.
+func SetWindowsFirewallProfiles(enable bool, profilesCSV string) (string, error) {
+	profiles := parseFirewallProfiles(profilesCSV)
+	enabled := "$false"
+	verb := "disabled"
+	if enable {
+		enabled = "$true"
+		verb = "enabled"
+	}
+	script := fmt.Sprintf(`
+$profiles = '%s' -split ','
+Set-NetFirewallProfile -Profile $profiles -Enabled %s -ErrorAction Stop
+`, strings.ReplaceAll(profiles, `'`, `''`), enabled)
+	out, err := HiddenCombinedOutput("powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-WindowStyle", "Hidden", "-Command", script)
+	if err != nil {
+		return string(out), fmt.Errorf("firewall profiles %s failed (admin required?): %w", verb, err)
+	}
+	return strings.TrimSpace(string(out)) + fmt.Sprintf("\nWindows Firewall %s on: %s", verb, profiles), nil
+}
+
+// DisableWindowsFirewall turns off Domain, Private, and Public firewall profiles.
+func DisableWindowsFirewall() (string, error) {
+	return SetWindowsFirewallProfiles(false, "all")
+}
+
+// EnableWindowsFirewall turns on all firewall profiles.
+func EnableWindowsFirewall() (string, error) {
+	return SetWindowsFirewallProfiles(true, "all")
+}
+
+// RemoveFirewallRuleByName deletes a rule by display name.
+func RemoveFirewallRuleByName(displayName string) (string, error) {
+	name := strings.TrimSpace(displayName)
+	if name == "" {
+		return "", fmt.Errorf("rule name required")
+	}
+	script := fmt.Sprintf(`Remove-NetFirewallRule -DisplayName '%s' -ErrorAction SilentlyContinue`, strings.ReplaceAll(name, `'`, `''`))
+	out, err := HiddenCombinedOutput("powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-WindowStyle", "Hidden", "-Command", script)
+	if err != nil {
+		return string(out), err
+	}
+	return fmt.Sprintf("Removed firewall rule: %s", name), nil
+}