Supervise the pinned websocket app-server with launchd

[cbusillo]

Summary

• generate a versioned user LaunchAgent that directly owns the pinned managed app-server
• validate caller-supplied digest/commit/version, release provenance, Developer ID identity, and updater absence
• fail closed on engine drift, legacy PID-daemon conflicts, and occupied loopback ports
• expose install/status/uninstall primitives with atomic file replacement and rollback
• verify the live launchd PID, executable, command line, and listening port

Validation

• uv run python -m unittest discover -s codex_lab_package -p 'test_*.py' (71 passed)
• just fmt
• installed LaunchAgent dev.everycode.codex-lab.app-server.v1 healthy on ws://127.0.0.1:4766/rpc
• crash canary: launchd replaced PID 27660 with PID 33872; ChatGPT made websocket-only reconnect attempts and reinitialized in 15 seconds with no stdio_transport_spawned
• legacy detached daemon/updater migration and stale launchd cleanup are explicit

Relates to #459 and #385.