A code and policy audit of PhoneBuddySDK shows why mobile AI agents need an in-process runtime, plus the evidence still required to ship.