fix: serialize launchd plist safely

[git-ksk]

Summary

• Replace manual XML string interpolation in _build_plist() with plistlib.
• Preserve the existing launchd keys and values.
• Safely encode special characters in executable paths, arguments, and log paths.

Reproduction

With the current implementation, a ProgramArgument such as /tmp/tool&name or a config/log path containing &, <, or > is inserted into XML unescaped. Parsing the generated plist then fails with ExpatError: not well-formed.

Root cause

_build_plist() manually interpolates arbitrary strings into XML <string> elements instead of using a plist serializer.

Validation

• focused special-character round-trip test: 1 passed
• full suite: 320 passed
• generated plist passes macOS plutil -lint
• special characters round-trip through the generated plist unchanged
• git diff --check: clean
• no added line exceeds the repository's 100-character limit
• ruff check .: 462 findings, identical to upstream/main's pre-existing baseline
• ruff format --check .: same 26 pre-existing unformatted files as upstream/main; the new test file is formatted

Compatibility

The generated plist keeps the same launchd semantics:

• Label
• ProgramArguments
• RunAtLoad
• KeepAlive
• StandardOutPath
• StandardErrorPath

Only serialization/escaping is changed; textual XML formatting is intentionally not treated as an API.

Non-changes

• no launchd startup acceptance changes from PR fix: verify launchd server startup after install #58
• no TCC changes
• no signing/notarization changes or Issue Feature request: ship a code-signed + notarized release so TCC attributes access to one named entity #25 work