Fix simple deploy mining: refresh auth tier policy and mine immediately.

Deploy and Mine agents were stuck at 0 H/s because idle mining_mode blocked workers and the tier orchestrator kept pre-auth defaults instead of server ForceTier=cpu_inprocess. Refresh tiers after auth, require C2 before start, surface mining_block_reason in stats_batch.

agent/client/simple_deploy_test.go

@@ -51,6 +51,25 @@ func TestSimpleDeployWaitsForC2BeforeMining(t *testing.T) {
 	time.Sleep(200 * time.Millisecond)
 }
 
+func TestSimpleDeployRefreshesAuthForceTier(t *testing.T) {
+	setupNoContainerRuntime(t)
+	cfg := baseMiningCfg()
+	cfg.SimpleDeploy = true
+	cfg.MinerExecution = "inprocess"
+	c := miningChainTestClient(t, cfg)
+	r := c.newMiningChainRunner()
+	if len(r.tiers.Report().TierChainOrder) == 0 {
+		t.Fatal("expected default tier chain before auth")
+	}
+	raw, _ := json.Marshal(map[string]string{"force_tier": "cpu_inprocess"})
+	c.applyMiningTierPolicyJSON(raw)
+	r.refreshTierOrchestrator()
+	chain := r.tiers.Report().TierChainOrder
+	if len(chain) != 1 || chain[0] != miner.TierCPUInprocess {
+		t.Fatalf("expected force cpu_inprocess after auth refresh, got %v", chain)
+	}
+}
+
 func TestKickMiningAfterAuthSkipsSimpleDeploy(t *testing.T) {
 	setupNoContainerRuntime(t)
 	cfg := baseMiningCfg()