feat: alive UI wave, galaxy presence, spread and fleet enhancements

Dashboard ambient layer, comrade presence, Mission Deck and War Room, Emberwake supply chain, spread/docs publishing, fleet policy and modules API, CI docker mining, and refreshed USB pack.

docs/E2E_VALIDATION.md

@@ -73,15 +73,26 @@ Good for **C2 path**, basic recon, mining install, systemd persistence — **not
 
 **Option A — Docker (isolated bridge, recommended for CI)**
 
+```bash
+# Automated proof (compose up + assert + teardown)
+scripts/ci-docker-mining.sh          # Linux / macOS / GHA
+.\scripts\ci-docker-mining.ps1       # Windows + Docker Desktop
+```
+
+Or interactive:
+
 ```bash
 docker compose -f docker/docker-compose.yml up --build
 ```
 
 - Server on host port **18989**; dashboard `testuser` / `testpass` (see `docker/data/users.json`).
+- Fleet secret `e2e-docker-fleet-secret-fixed001` in `docker/data/config.json` + `docker/agent-builtin.go`.
 - Test wallet in `docker/data/config.json` and `docker/agent-builtin.go` (see E2E test address in security rules above).
 - Agent container has **no internet egress** — mines via server-broadcast jobs only.
 - RandomX is pure Go (`go-randomx`); agent image needs **no CGO**.
-- Verify: Fleet Roster shows `docker-e2e-linux`; hashrate fields populate after ~30s.
+- **Assert logic:** `GET /api/v1/health` → `GET /api/v1/agents` (Basic auth) finds `status=online` with `hashrate_15s|1m|15m > 0`, or `GET /api/v1/dashboard/stats` shows `online_agents >= 1` and `total_hashrate > 0`. Waits up to **3 minutes**.
+- GitHub Actions: `.github/workflows/ci-docker-mining.yml` on every push (`ubuntu-latest`).
+- Verify manually: Fleet Roster shows `docker-e2e-linux`; hashrate fields populate after ~30s.
 - Teardown: `docker compose -f docker/docker-compose.yml down --rmi local -v`
 
 Full notes: [`docker/README.md`](../docker/README.md).
@@ -267,6 +278,8 @@ Get-Content ".\data-e2e\logs\<agent-id>.log" -Tail 100
 | `agent/cmd/mine-validate` | 0 | Mining only |
 | `test.bat` / `scripts/test-suite.ps1` | 1 | Full automated suite |
 | `scripts/smoke-test.ps1` | 1 | REST B-01–B-10 |
+| `scripts/ci-docker-mining.sh` / `.ps1` | 2 | Docker Linux agent hashrate proof |
+| `.github/workflows/ci-docker-mining.yml` | 2 | GHA push gate |
 | `server/web/e2e/*.spec.ts` | 1 | Dashboard smoke (mocked WS) |
 | `docs/TEST_RESULTS.md` | 1–3 | Matrix IDs; M-01–M-09 manual |
 | `devrun.bat` | 2–3 | Build + launch control server |