macos: keep launchagent stable on --no-sign

apps/macos/Sources/Clawdbot/GatewayLaunchAgentManager.swift

@@ -4,6 +4,7 @@ enum GatewayLaunchAgentManager {
     private static let logger = Logger(subsystem: "com.clawdbot", category: "gateway.launchd")
     private static let supportedBindModes: Set<String> = ["loopback", "tailnet", "lan", "auto"]
     private static let legacyGatewayLaunchdLabel = "com.steipete.clawdbot.gateway"
+    private static let disableLaunchAgentMarker = ".clawdbot/disable-launchagent"
 
     private static var plistURL: URL {
         FileManager.default.homeDirectoryForCurrentUser
@@ -50,6 +51,10 @@ enum GatewayLaunchAgentManager {
     }
 
     static func set(enabled: Bool, bundlePath: String, port: Int) async -> String? {
+        if enabled, self.isLaunchAgentWriteDisabled() {
+            self.logger.info("launchd enable skipped (attach-only or disable marker set)")
+            return nil
+        }
         if enabled {
             _ = await Launchctl.run(["bootout", "gui/\(getuid())/\(self.legacyGatewayLaunchdLabel)"])
             try? FileManager.default.removeItem(at: self.legacyPlistURL)
@@ -301,6 +306,17 @@ enum GatewayLaunchAgentManager {
     }
 }
 
+extension GatewayLaunchAgentManager {
+    private static func isLaunchAgentWriteDisabled() -> Bool {
+        if UserDefaults.standard.bool(forKey: attachExistingGatewayOnlyKey) {
+            return true
+        }
+        let marker = FileManager.default.homeDirectoryForCurrentUser
+            .appendingPathComponent(self.disableLaunchAgentMarker)
+        return FileManager.default.fileExists(atPath: marker.path)
+    }
+}
+
 #if DEBUG
 extension GatewayLaunchAgentManager {
     static func _testGatewayExecutablePath(bundlePath: String) -> String {