feat: alive UI wave, galaxy presence, spread and fleet enhancements

Dashboard ambient layer, comrade presence, Mission Deck and War Room, Emberwake supply chain, spread/docs publishing, fleet policy and modules API, CI docker mining, and refreshed USB pack.

docker/README.md

@@ -45,6 +45,27 @@ docker compose -f docker/docker-compose.yml logs agent
 3. **Server logs** — `docker compose -f docker/docker-compose.yml logs -f server` — look for agent stats WS messages and share submissions if enabled.
 4. **Agent log** — `docker compose -f docker/docker-compose.yml exec agent cat /tmp/miner.log` (if present).
 
+## CI mining proof (automated)
+
+Every push can prove the Linux agent connects and reports **hashrate > 0** without manual dashboard checks.
+
+```bash
+# Linux / macOS / GitHub Actions
+scripts/ci-docker-mining.sh
+
+# Windows (Docker Desktop)
+.\scripts\ci-docker-mining.ps1
+```
+
+The script:
+
+1. `docker compose -f docker/docker-compose.yml up --build -d`
+2. Waits up to **3 minutes** for `GET /api/v1/health` + agent online
+3. Asserts via `GET /api/v1/agents` (Basic auth) **or** `GET /api/v1/dashboard/stats` — online agent with `hashrate_15s|1m|15m > 0`
+4. Tears down compose (`down --rmi local -v`)
+
+GitHub Actions: `.github/workflows/ci-docker-mining.yml` (ubuntu-latest; Docker preinstalled).
+
 ## Teardown
 
 ```bash
@@ -69,6 +90,7 @@ The wallet is baked into `docker/data/config.json` (server pool login) and `dock
 | Agent exits immediately | `logs agent` — wallet/server URL baked in `docker/agent-builtin.go` |
 | Auth rejected | `fleet_secret` must match in `docker/data/config.json` and `docker/agent-builtin.go` |
 | Hashrate 0 forever | Server pool connectivity — server needs default-network egress |
+| CI proof times out | `docker compose logs agent server`; allow 3 min after `up -d`; pool may be slow |
 | Idle mode never mines | Use `mining_mode: always` in docker builtin (default here) |
 
 ## Host server alternative

docker/docker-compose.yml

@@ -26,6 +26,9 @@ services:
     networks:
       - e2e-internal
     restart: "no"
+    # RandomX dataset + Go runtime — avoid OOM kills in CI runners.
+    mem_limit: 1g
+    shm_size: 256m
 
 networks:
   e2e-internal: