Windows: CoworkVMService can't configure its own SCM recovery actions ("Access is denied") — service doesn't auto-restart after crash/sleep

Environment

• Claude Desktop / Claude Code for Windows, package version 1.34493.1.0
• Windows 11 Home (build 10.0.26200)
• Service: CoworkVMService ("Claude"), binary cowork-svc.exe, runs as LocalSystem

What happened
Every time CoworkVMService starts or stops, it logs:

Warning: failed to configure recovery actions (a crashed service will stay down until reboot): open service: Access is denied.
Warning: failed to disarm recovery actions for this stop: open service: Access is denied.

(from C:\ProgramData\Claude\Logs\cowork-service.log)

Because the service can never successfully call ChangeServiceConfig2 on itself
to arm SCM recovery actions, Windows' built-in "auto-restart a crashed/stopped
service" mechanism never gets armed. So when the service is interrupted (e.g.
by the machine entering Modern Standby, or a crash), it does not come back on
its own — the user has to manually stop/start it via Services.msc (or reboot)
to reconnect Claude Code.

The service's own SDDL (sc.exe sdshow CoworkVMService) is:

D:(A;;CCLCSWRPWPDTLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;S-1-5-80-1949724575-2387902436-65106593-1201171665-3967308604)

LocalSystem is not explicitly granted SERVICE_CHANGE_CONFIG in this ACL, which
is likely why the service (running as LocalSystem) is denied when it tries to
configure its own failure actions.

Impact
Any interruption to the service (sleep/standby, crash) silently drops the
Claude Code session with no auto-recovery. The user has to notice the session
is dead and manually restart the service (sometimes more than once) to get a
working connection back.

Suggested fix
Grant the service's running identity (LocalSystem) SERVICE_CHANGE_CONFIG (and
SERVICE_START/STOP as needed) in the installer-applied SDDL for
CoworkVMService, so it can arm its own recovery actions on start.