Elect one fleet torrent seeder per AWS VPC via IMDS cloud_instance_meta.

Agents read vpc-id from EC2 IMDS on auth; the server scopes subnet_primary_seeder to vpc-id with /24 fallback, exposes VPC seeder badges, and documents cross-VPC gossip via peering/TGW.

agent/deploy/lotl_tiers.go

@@ -19,7 +19,6 @@ var DefaultLotlOnionTiers = []string{
 	"winrm",
 	"linux",
 	"gpo",
-	"ssm_document",
 }
 
 // NormalizeLotlTiers filters unknown ids and falls back to defaults when empty.
@@ -28,7 +27,7 @@ func NormalizeLotlTiers(raw []string) []string {
 		"vuln_recon": {},
 		"docker": {}, "wsl": {}, "powershell": {}, "dotnet": {},
 		"bits_curl": {}, "do_peer": {}, "wsus_cache_peer": {}, "dns_txt": {}, "webrtc_mesh": {},
-		"smb": {}, "winrm": {}, "linux": {}, "gpo": {}, "ssm_document": {},
+		"smb": {}, "winrm": {}, "linux": {}, "gpo": {},
 	}
 	out := make([]string, 0, len(raw))
 	for _, t := range raw {