Capture media keys as remap triggers (function-key remapper M3)

## Summary

The function-key remapper shipped its M1 and M2 milestones in #344: F1-F12/Esc capture with modifier combos, the `TypeText`/`RunAppleScript`/`RunShellCommand` actions, and the `Workflow` sequencer. The spec's M3 - remapping volume/brightness/emoji media keys - was explicitly gated on a feasibility test and never attempted.

## Feasibility gate (do this before any design commitment)

macOS routes media keys through `NX_SYSDEFINED` system events, a separate stream from the `CGEventTap` the hook owns today. Empirically test whether those keys are interceptable via a system-event tap; if the OS grabs them below the tap, descope or close this. (The related Fn-modifier probe is recorded in `docs/DECISIONS.md`: firmware keeps Fn internal except on function-row keys, so Fn itself is not capturable - the same investigation warned media keys may behave likewise.)

## If feasible

A new system-event tap subsystem in `openlogi-hook`, plus extending the trigger vocabulary to media keys. The posting side already exists - `openlogi-inject` posts NSSystemDefined subtype-8 media events since #184 - so this is capture-only. The usual tap-lifecycle hazards apply (a wedged tap freezes input machine-wide); see `.claude/rules/hook.md`.

Full design: [specs/2026-06-30-function-key-remapper-design.md @ 91fe5d80](https://github.com/AprilNEA/OpenLogi/blob/91fe5d80f3a2c16cf16061b3abb5a01d47fc8637/docs/superpowers/specs/2026-06-30-function-key-remapper-design.md), sections "Milestones" and "Risks".

Start with the feasibility gate in openlogi-hook: test whether macOS media keys can be intercepted through a system-event tap, using the Fn findings in docs/DECISIONS.md for context. Read .claude/rules/hook.md for tap-lifecycle hazards and the referenced design spec's Milestones and Risks. Done means establishing whether capture is feasible before committing to implementation or descope.

Written by the indexing model from the issue text.