Refresh watchdog registration after app upgrades

[danbao]

Summary

• refresh an enabled watchdog registration when the installed app build changes, so macOS launches the helper from the upgraded bundle
• wait for SMAppService asynchronous unregistration before re-registering, with bounded retry and a secure pending marker for interrupted refreshes
• preserve the user's final Launch at Login choice across approval, disable, and rapid disable/re-enable races
• document the local registration markers and keep user-derived errors private in logs

Root cause

Replacing GlancePane.app updates the helper on disk but does not replace an already-running watchdog or repair a stale SMAppService registration. Killing the old helper can then leave launchd unable to spawn the registered job. The app previously had no build-aware registration refresh.

Verification

• sh scripts/test.sh — 83/83 passed
• sh scripts/build.sh
• sh scripts/package-dmg.sh — app signature and designated requirement verified
• sh scripts/audit-public-tree.sh
• git diff --check origin/main...HEAD

The test matrix includes same-build launches, upgrades, transient and exhausted registration failures, pending recovery, requiresApproval, disabled state, legacy migration, and in-flight disable/re-enable races.