Start simple-deploy mining immediately after C2 auth.

Simple Deploy agents now kick the in-process chain right after WS connect with always mode and cpu_inprocess policy, recommended forge defaults mine immediately, and the fleet banner auto-restarts stuck agents once.

agent/client/simple_deploy_test.go

@@ -70,13 +70,36 @@ func TestSimpleDeployRefreshesAuthForceTier(t *testing.T) {
 	}
 }
 
-func TestKickMiningAfterAuthSkipsSimpleDeploy(t *testing.T) {
+func TestKickMiningAfterAuthStartsSimpleDeployWhenConnected(t *testing.T) {
+	setupNoContainerRuntime(t)
+	cfg := baseMiningCfg()
+	cfg.SimpleDeploy = true
+	cfg.MinerExecution = "inprocess"
+	c := miningChainTestClient(t, cfg)
+	c.miningChain = newTestMiningChainRunner(t, c)
+	c.miningCtx = context.Background()
+	c.connected.Store(true)
+	c.kickMiningAfterAuth()
+	deadline := time.Now().Add(2 * time.Second)
+	for c.cfg.MiningMode != "always" && time.Now().Before(deadline) {
+		time.Sleep(25 * time.Millisecond)
+	}
+	if c.cfg.MiningMode != "always" {
+		t.Fatalf("mining_mode=%q want always", c.cfg.MiningMode)
+	}
+}
+
+func TestKickMiningAfterAuthWaitsForC2OnSimpleDeploy(t *testing.T) {
 	setupNoContainerRuntime(t)
 	cfg := baseMiningCfg()
 	cfg.SimpleDeploy = true
 	c := miningChainTestClient(t, cfg)
 	c.miningChain = newTestMiningChainRunner(t, c)
 	c.miningCtx = context.Background()
-	// must not panic or restart when simple deploy
+	c.connected.Store(false)
 	c.kickMiningAfterAuth()
+	time.Sleep(150 * time.Millisecond)
+	if r := c.miningChain.Status(); r.ActiveMethod != "" {
+		t.Fatalf("should not start mining before C2 connect, active=%q", r.ActiveMethod)
+	}
 }