Self-hosted CI workers need the ci-reporting authentication agent to remain available across terminal sessions, crashes, and host restarts. Running tng auth agent serve manually leaves VM jobs unable to authenticate whenever that foreground process is not running.
Add service management for the authentication agent on macOS, following the existing instance-oriented service workflow where practical.
The service workflow should:
- install and uninstall a per-user LaunchAgent;
- start, restart, and report the status of a named instance;
- configure the profile, session file, and Unix socket without embedding credentials in the property list;
- restart after unexpected termination;
- handle stale Unix sockets safely;
- keep logs in a predictable per-instance location; and
- support separate instances for multiple Tangled accounts.
Service diagnostics should distinguish a stopped process, an invalid or expired session, an unavailable socket, and an incompatible authentication-agent protocol.