Fix Kimaki launchd stale OpenCode cleanup

[chubes4]

Summary

• Add a wp-coding-agents-owned launchd entrypoint for managed Kimaki so macOS gets the same stale opencode serve cleanup and post-upgrade preflight as systemd.
• Sync the launchd wrapper into durable kimaki-config during install/upgrade and render launchd plists through it.
• Tighten the managed Kimaki live rig to fail when OpenCode serve processes exist outside managed Kimaki ancestry.

Tests

• tests/bridge-render.sh
• tests/kimaki-launchd-start.sh
• bash tests/kimaki-managed-plugin-rig.sh
• node tests/effective-prompt/run.mjs
• bash tests/post-upgrade-restore.sh

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (GPT-5.5)
• Used for: Drafted the launchd wrapper, bridge integration, rig assertion, and targeted test coverage; Chris directed the repository boundary and wp-coding-agents-only fix.

[chubes4]

Live verification after applying this branch to the local Kimaki launchd install:

• ./upgrade.sh --wp-path /Users/chubes/Studio/intelligence-chubes4 --kimaki-only --skip-plugins installed ~/.kimaki/kimaki-config/launchd-start.sh and updated ~/Library/LaunchAgents/com.wp.kimaki.plist.
• launchctl print gui/501/com.wp.kimaki shows the running service program is ~/.kimaki/kimaki-config/launchd-start.sh.
• Strict live rig passed after restart:
  • node scripts/kimaki-managed-plugin-rig.mjs --check-live --live-site-dir /Users/chubes/Studio/intelligence-chubes4 --live-kimaki-data-dir /Users/chubes/.kimaki --artifact-dir /var/folders/lr/c_cmmt7s0592m4njz99v5yb40000gn/T/opencode/kimaki-managed-live-proof-after-wrapper
  • Result: PASS kimaki managed-plugin rig

This proves the live managed prompt replacement path is active and no stale opencode serve processes remain outside managed Kimaki ancestry after the launchd wrapper restart.