fix(service): macOS stop is sticky — KeepAlive only on non-zero exit
launchd plist now emits KeepAlive as {"SuccessfulExit": False} so a clean SIGTERM exit stays stopped while crashes still recover.
Mirrors Linux's Restart=on-failure semantics.
Test updates: round-trip assertion shape plus new test_keep_alive_is_sticky_stop regression guard.