Always-on operational event monitors

Additional architecture decisions

• 01Fingerprints status, update time and content so only new or materially changed events generate notifications.
• 02Allowlisted sources and services constrain scope; sanitized summaries remove signatures, personal details and irrelevant boilerplate.
• 03The first run creates a baseline without flooding the channel; controlled test modes do not mutate production state.
• 04Windows SYSTEM tasks, isolated environments, restart recovery, logs and preserved state support unattended operation.