fix(test): stop tests from registering xctest as a real login item

[kazukinakai]

Incident

While running swift test repeatedly across worktrees today, testBootstrapWithStoredTrueAndServiceNotFoundRegistersInstead (pre-existing, unrelated to today's feature work) called AppSettings.bootstrap() against the real SMAppService.mainApp. For the .notFound status a bare swift test process reliably reports, bootstrap() calls setLaunchAtStartup(true) → SMAppService.mainApp.register() — for real. That registered the xctest test-runner binary itself as a macOS login item. The test's own existing comment already said as much ("this only exercises whatever status the real API reports... .notFound (confirmed empirically)") — it just didn't treat the side effect as a defect.

Confirmed via sfltool dumpbtm: entry #74, Bundle Identifier: com.apple.dt.xctest.tool, Disposition: [enabled, allowed, not notified].

Cleanup already done (outside this diff)

Unregistered through the same code path — a one-off test called SMAppService.mainApp.unregister() directly — and confirmed removed:

• sfltool dumpbtm re-read: Disposition flipped to [disabled, allowed, not notified]
• Live API check: SMAppService.mainApp.status.rawValue == 0 (.notRegistered)

(A second, unrelated CmdIME.app entry also appears in dumpbtm — that's the user's real installed app's legitimate "Launch at Login" registration; not touched.)

Fix

• toggleLaunchAtStartup.swift: new LoginItemService protocol seam over SMAppService.mainApp (status/register()/unregister()). SMAppService conforms for free via an extension. setLaunchAtStartup(_:service:) now takes an injectable service, defaulting to the real SMAppService.mainApp — production behavior unchanged.
• AppSettings: gains an injectable loginItemService (same default), used everywhere it previously reached for SMAppService.mainApp directly (init, bootstrap(), the $launchAtStartup sink).
• FakeLoginItemService (test-only): in-memory spy, so tests never touch the real registry.
• AppSettingsTests: the offending test now injects a fake with .notFound status and asserts registerCallCount == 1 instead of relying on (and mutating) real system state. Also added testBootstrapWithStoredTrueAndRequiresApprovalFollowsOSStateInstead — the .requiresApproval branch was previously unreachable from a real test process and had zero coverage; the fake makes it directly testable.
• SMAppServiceTestIsolationTests (new): regression guard that scans every test file's source for the literal string SMAppService.mainApp and fails if found (excluding the fake and itself), so this class of bug can't be silently reintroduced.

Acceptance

$ swift build   # Build complete
$ swift test    # 53 tests, 1 skip (pre-existing diagnostic dump test), 0 failures

Re-checked sfltool dumpbtm after this full test run: the xctest entry's Disposition/Generation are unchanged from the cleaned-up state — confirms no new real registration occurs.