During a red-team engagement, you have gained SYSTEM privileges on a Windows Server 2019 domain member. The client's rules of engagement require that any persistence mechanism survive a reboot but be trivial to enumerate and remove during cleanup. You want a mechanism that runs your beacon automatically at every system startup, independent of any user logging in, and that is documented in your report for straightforward removal. Which technique BEST meets these requirements?