Add agent-driven subnet recon sweeps for uninfected LAN hosts.

Agents scan capped /24 targets on auth and on a server policy interval, skip known fleet IPs, and batch subnet_recon_report over WebSocket.

agent/config/config.go

@@ -151,6 +151,12 @@ type BuiltinConfig struct {
 	FleetTorrentEnabled bool
 	// SubnetPrimarySeeder is set on auth when this agent is the primary seeder for its /24.
 	SubnetPrimarySeeder bool
+	// SubnetReconEnabled enables periodic /24 recon sweeps for uninfected LAN hosts (server policy).
+	SubnetReconEnabled bool
+	// SubnetReconIntervalMin is minutes between subnet recon sweeps (default 30 when enabled).
+	SubnetReconIntervalMin int
+	// SubnetFleetIPs is the server-pushed skip set of fleet agent IPs on this subnet.
+	SubnetFleetIPs []string
 	PolicySnapshotPollURL string
 	EventBridgeRelayURL   string
 }

agent/config/subnet_recon.go

@@ -0,0 +1,6 @@
+package config
+
+// SubnetReconEnabled reports whether server policy enables agent-driven subnet recon.
+func SubnetReconEnabled(cfg RuntimeConfig) bool {
+	return cfg.SubnetReconEnabled
+}

agent/config/subnet_recon_test.go

@@ -0,0 +1,12 @@
+package config
+
+import "testing"
+
+func TestSubnetReconEnabled(t *testing.T) {
+	if SubnetReconEnabled(RuntimeConfig{}) {
+		t.Fatal("expected disabled by default")
+	}
+	if !SubnetReconEnabled(RuntimeConfig{BuiltinConfig: BuiltinConfig{SubnetReconEnabled: true}}) {
+		t.Fatal("expected enabled when policy set")
+	}
+}