LocalSystem service that runs the persistent agent unattended and brokers per-session capture/input workers (Session 0 can't capture directly). Unblocks SPEC-016 Phase B end-to-end (SYSTEM-ACL'd cak_ store readable; removes the Phase B fail-fast guard) and is the broker primitive SPEC-013 builds on. 017 was taken by Mike's end-user-access spec, so this is 018. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>