what does the zed flag "--permissions-system" do? It doesn't seem to make any difference whether I specify it or not in my local testing. Is it only for the managed service?

yes, this is for Authzed Serverless, not needed for OSS SpiceDB