fix: serialize launchd plist safely

[git-ksk]

Summary

• replace manual XML string interpolation in _build_plist() with plistlib
• preserve the existing launchd keys and values
• safely encode special characters in executable paths, arguments, and log paths

Reproduction

With the current implementation, a ProgramArgument such as /tmp/tool&name or a config/log path containing &, <, or > is inserted into XML unescaped. Parsing the generated plist then fails with ExpatError: not well-formed.

Root cause

_build_plist() manually interpolates arbitrary strings into XML <string> elements instead of using a plist serializer.

Validation

• focused special-character round-trip test: 1 passed
• full suite: 320 passed
• git diff --check clean

Compatibility

The generated plist keeps the same launchd semantics:

• Label
• ProgramArguments
• RunAtLoad
• KeepAlive
• StandardOutPath
• StandardErrorPath

Only serialization/escaping is changed; textual XML formatting is intentionally not treated as an API.

Non-changes

• no launchd startup acceptance changes from PR fix: verify launchd server startup after install #58
• no TCC changes
• no signing/notarization changes or Issue Feature request: ship a code-signed + notarized release so TCC attributes access to one named entity #25 work

[git-ksk]

Closing temporarily for a final pre-PR repository-guideline review. The branch is preserved; this will only be reopened after the final scope/style/test review is complete.

[git-ksk]

Superseded by #64. The fork branch was amended after the contribution-guideline audit, and GitHub does not allow reopening this PR after that force-push.