fix(gateway): use unconditional KeepAlive in launchd plist

[IISweetHeartII]

Summary

The generated launchd plist uses KeepAlive > SuccessfulExit = false, which means the gateway is not restarted when it exits with code 0 (clean exit). This causes the gateway to silently die and never recover in several real-world scenarios:

• Discord slash command sync failure → gateway shuts down gracefully (exit 0) → launchd doesn't restart
• --replace logic detects stale processes → exits cleanly → launchd doesn't restart
• Any transient error handled with a graceful shutdown path

Before

<key>KeepAlive</key>
<dict>
    <key>SuccessfulExit</key>
    <false/>
</dict>

Gateway exits with code 0 → stays dead. Cron jobs stop firing. No recovery until manual restart.

After

<key>KeepAlive</key>
<true/>

<key>ThrottleInterval</key>
<integer>5</integer>

Gateway always restarts regardless of exit code. ThrottleInterval: 5 prevents overly aggressive restart loops.

Why this is safe

launchd_stop() already uses launchctl bootout which fully unloads the service definition, preventing KeepAlive from respawning. So intentional stops (via hermes gateway stop or hermes update) are completely unaffected.

Test plan

• Gateway restarts automatically after exit 0 (previously stayed dead)
• Gateway restarts after crash (non-zero exit) — unchanged behavior
• hermes gateway stop / hermes update still cleanly stop the gateway
• No restart loop — ThrottleInterval prevents rapid cycling
• hermes cron status reports gateway as running after restart

Fixes #9659

[teknium1]

Thanks for the contribution, @IISweetHeartII!

Closing this as a duplicate of #9689 (by @digging-airfare-4u), which targets the same fix/feature. We're consolidating on that PR for review.

If you want to help push it over the line, please jump in there — or if you think your approach is better for a specific reason that isn't covered in the other PR, let us know and we can reopen.