0.17 phase 5 PR C: defaults_keys, chown_owner_group, macos apps + spec patches

[StanMarek]

Summary

• Task 6: Adds NEEDS_PREV_ARG constant + inject_prev_arg helper in crates/gc-suggest/src/providers/mod.rs; the gc-pty handler now copies ctx.args.last() into params["prev_arg"] for the listed kinds (today: DefaultsKeys).
• Task 7: New defaults_keys provider parses the top-level keys of defaults read <domain> output (brace+paren depth tracked across nested dicts/arrays, conservative on ambiguity). specs/defaults.json routes read/write/delete/rename/read-type key args to it.
• Task 8: New chown_owner_group colon-aware provider replaces the legacy [dscl_users, dscl_groups] pair on chown's first arg. Pre-prefixes OWNER:GROUP text so nucleo's : delimiter doesn't strand the user mid-token. read_users / read_groups reuse the existing dscl_principals helpers.
• Task 9: New macos_applications + macos_bundle_identifiers providers backed by Spotlight (mdfind for app paths, mdls -name kMDItemCFBundleIdentifier -raw per path, capped at 500 to bound worst-case latency). Spawn-time ENOENT → Ok(vec![]) so non-macOS hosts degrade silently.
• Task 10: Patches specs/open.json (-a → macos_applications, -b → macos_bundle_identifiers), specs/osascript.json (script arg → template: "filepaths", -l → static AppleScript/JavaScript), specs/codesign.json (-o → 8 static option suggestions, --entitlements/--keychain/--resource-rules → template: "filepaths", --preserve-metadata=list refactored into a --preserve-metadata flag + variadic args with 6 suggestions). Corpus invariant EXPECTED_UNSUPPORTED_WITHOUT_RUNTIME bumped 295 → 292.

Test plan

• cargo test -p gc-suggest defaults — 13 lib + 2 golden, all pass
• cargo test -p gc-suggest chown — 7 new colon-aware tests + 11 existing, all pass
• cargo test -p gc-suggest macos_apps — 6 lib + 2 integration, all pass
• cargo test -p gc-suggest --test golden_specs — 30/30 (incl. 7 new goldens: open -a/-b, osascript -l, codesign -o, chown, defaults read/write)
• cargo test -p gc-suggest engine — clean
• cargo clippy --all-targets -- -D warnings — clean
• cargo fmt --check — clean

Full workspace cargo test --workspace passes (720+ lib + integration tests).

References

docs/plans/0.17-polish-and-trust/5-macos-smart-completions/plan.md Tasks 6–10.