fix(mdm): report exhausted bg start retries as a failure

The retry loop's counter test made the fifth failure exit 0, so launchd and
systemd showed a successful login start with no daemon behind it. Exit 1
once the attempts are used up. Also reject --bin paths containing a newline,
which neither a unit file nor a plist string can carry safely.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>