pond schedule label is host-global, not install-scoped (multi-install / sandbox bleed)

[tenequm]

Symptom

• pond status under a non-default HOME/XDG still reports schedule active (launchd) (macOS) or the systemd timer state (Linux), because it reads the host-global scheduler, not this install's config.
• On macOS the launchd label sh.pond.sync is a fixed constant and launchctl bootout/bootstrap gui/<uid>/sh.pond.sync targets the user domain; on Linux systemctl --user always targets the single login user-manager regardless of XDG_CONFIG_HOME. So schedule start/stop from a second install or a sandbox operates on the user's real timer.

Impact

Two pond installs (e.g. homebrew + a dev build), or any sandboxed run, cannot manage schedules independently and can clobber each other's timer. pond status cross-reports a schedule the current config did not create.

Notes

Pre-existing design (one schedule per user). Not a regression. A fix would namespace the label/unit per store or config, which is a design decision beyond the launch PR (#90). Also worth documenting for Linux CI/test: pond schedule is not sandbox-isolable via XDG.

Found during launch-readiness verification of #90 (macOS strangers + Linux bl host).