feat(fleet): install-service — user LaunchAgent for start-on-login on macOS

New `install-service` / `uninstall-service` subcommands render a
LaunchAgent plist against the invoking binary path and the agent's
data-dir log path, write it to `~/Library/LaunchAgents/`, and drive
`launchctl bootstrap` / `bootout`. No sudo, no static plist file to
ship, no manual `launchctl` steps for the operator.

The plist runs `arcbox-fleet-agent serve` at login (RunAtLoad),
respawns only on non-zero exit (KeepAlive.SuccessfulExit=false — a
`launchctl bootout` SIGTERM lets the agent drain runners and exit
cleanly without getting resurrected), and tees launchd's own
stdout/stderr into the same log dir the agent's logger uses so
early-startup output before `arcbox_logging::init` still lands next
to the real logs.

Uninstall is idempotent — a `bootout` with the job not loaded and a
missing plist file both count as success, since the desired end
state is "not installed."

macOS-only for this cut. Linux systemd (user unit) is the natural
follow-up; the CLI shape stays uniform (subcommand exists everywhere,
bails with a clear message on non-macOS) so docs and completions
don't diverge.

Author: PeronGH

Cargo.lock

@@ -43,6 +43,8 @@ arcbox-protocol.workspace = true
 arcbox-constants.workspace = true
 russh = { version = "0.62.1", default-features = false, features = ["ring", "flate2"] }
 thiserror.workspace = true
+plist = "1.10.0"
+libc.workspace = true
 
 [lints]
 workspace = true

fleet/arcbox-fleet-agent/Cargo.toml

@@ -34,6 +34,8 @@ mod enroll;
 mod fsutil;
 mod host;
 mod runner;
+#[cfg(target_os = "macos")]
+mod service;
 mod settings;
 mod state;
 mod vm;
@@ -125,6 +127,16 @@ enum Command {
         /// supports.
         kinds: Vec<String>,
     },
+    /// Install a per-user LaunchAgent so `serve` starts on login (macOS).
+    ///
+    /// Renders the plist against the invoking binary (`env::current_exe()`)
+    /// and the agent's data-dir log path, writes it to
+    /// `~/Library/LaunchAgents/`, and `launchctl bootstrap`s it into the
+    /// current GUI session. Re-run after moving the binary.
+    InstallService,
+    /// Remove the LaunchAgent installed by `install-service` (macOS).
+    /// Idempotent — safe to run when nothing is installed.
+    UninstallService,
 }
 
 #[derive(Debug, Subcommand)]
@@ -444,9 +456,41 @@ async fn run(command: Command, config: AgentConfig) -> Result<()> {
             }
             Ok(())
         }
+        Command::InstallService => install_service(&config),
+        Command::UninstallService => uninstall_service(),
     }
 }
 
+/// macOS: install the LaunchAgent via [`service::install`]. Other Unix
+/// targets (Linux) bail with a pointer to the planned systemd support;
+/// keeping the subcommand in the CLI shape lets docs and tab-completion
+/// stay uniform across hosts.
+#[cfg(target_os = "macos")]
+fn install_service(config: &AgentConfig) -> Result<()> {
+    service::install(config)
+}
+
+#[cfg(not(target_os = "macos"))]
+fn install_service(_config: &AgentConfig) -> Result<()> {
+    anyhow::bail!(
+        "install-service is only implemented for macOS; Linux systemd (user unit) support \
+         is planned as a follow-up"
+    )
+}
+
+#[cfg(target_os = "macos")]
+fn uninstall_service() -> Result<()> {
+    service::uninstall()
+}
+
+#[cfg(not(target_os = "macos"))]
+fn uninstall_service() -> Result<()> {
+    anyhow::bail!(
+        "uninstall-service is only implemented for macOS; Linux systemd (user unit) support \
+         is planned as a follow-up"
+    )
+}
+
 /// Build a `CancellationToken` cancelled on the first termination signal
 /// (see [`shutdown_signal`]), logging `message` when it fires. Shared by
 /// `run` and `serve`, whose shutdown trigger is otherwise identical.