fix(agent): point Phase B fail-fast guard at SPEC-018

The SPEC-016 Phase B credential-store guard referenced "SPEC-017" for the
forthcoming SYSTEM service host, but 017 is now Mike's end-user-access
spec; the service host is SPEC-018. Comment + error-string text only, no
logic change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

agent/src/credential_store.rs

@@ -146,7 +146,7 @@ pub fn store_cak(cak: &str) -> Result<()> {
             "[ENROLL] wrote the credential store but cannot read it back in THIS security \
              context (access denied). The store is ACL'd to SYSTEM + Administrators by \
              design; the managed agent must run as the GuruConnect SYSTEM service (see \
-             SPEC-017) to read it. Refusing to leave an unreadable store behind."
+             SPEC-018) to read it. Refusing to leave an unreadable store behind."
         )),
         Err(e) => Err(anyhow::Error::new(e)
             .context("stored the credential but the immediate read-back verification failed")),