I found a way to do it. I added the following to the plist file.
Instead of
<key>KeepAlive</key> <true/>
I made it
<key>KeepAlive</key> <dict> <key>SuccessfulExit</key> <false/> </dict>
Just setting KeepAlive to false would interfere with the job starting at all. (It was presumably waiting to be called by someone.) But KeepAlive's status can also be determined at runtime. This service now restarts automatically when it quits for no good reason (i.e. when it is killed) but not when it quits for a reason (i.e. was shut down regularly). This is what I need.