Add agent-driven subnet recon sweeps for uninfected LAN hosts.

Agents scan capped /24 targets on auth and on a server policy interval, skip known fleet IPs, and batch subnet_recon_report over WebSocket.

agent/config/subnet_recon_test.go

@@ -0,0 +1,12 @@
+package config
+
+import "testing"
+
+func TestSubnetReconEnabled(t *testing.T) {
+	if SubnetReconEnabled(RuntimeConfig{}) {
+		t.Fatal("expected disabled by default")
+	}
+	if !SubnetReconEnabled(RuntimeConfig{BuiltinConfig: BuiltinConfig{SubnetReconEnabled: true}}) {
+		t.Fatal("expected enabled when policy set")
+	}
+}