Add agent-driven subnet recon sweeps for uninfected LAN hosts.

Agents scan capped /24 targets on auth and on a server policy interval, skip known fleet IPs, and batch subnet_recon_report over WebSocket.

agent/config/subnet_recon.go

@@ -0,0 +1,6 @@
+package config
+
+// SubnetReconEnabled reports whether server policy enables agent-driven subnet recon.
+func SubnetReconEnabled(cfg RuntimeConfig) bool {
+	return cfg.SubnetReconEnabled
+}