Filed FB22119525 with detailed unified log captures and a minimal reproducer. Includes side-by-side log comparisons of the same authorization request (AssetSonar requesting system.privilege.admin) with and without SecurityAgent spawning, showing the focus steal chain.