v2: Make Photos a PhotoKit-first evidence-backed provider

[jmcte]

Problem / intent

photos list currently walks files inside the Photos library package; it cannot reliably represent logical assets, albums, favorites, cloud availability, or stable Photos identifiers. OpenClaw's photoscrawl demonstrates a PhotoKit-first, read-only archive with evidence/provenance and no implicit iCloud downloads.

Acceptance criteria

• Use PhotoKit as the primary logical asset source with explicit authorization status.
• Preserve current read-only commands while returning real asset ids, media type, dates, dimensions, favorite/hidden state, album membership, and local/cloud availability where public APIs expose them.
• Do not export pixels or trigger iCloud downloads by default.
• Classify filesystem/private-store fallback output as degraded and preserve source provenance.
• Separate source facts from any later derived OCR/classification observations.
• Add synthetic/provider-boundary tests and a privacy-preserving live smoke path.
• Document unsupported fields and macOS-version behavior.

Dependencies

• Depends on v2: Define a versioned provider capability manifest #89; archive work depends on the resumable archive issue.
• Private-store fallback should use v2: Snapshot live SQLite stores consistently before querying #90.
• v2 follow-up to closed Photos issues Add photos and screenshots inventory command #18 and Extend photos with shared-album and Shared Library inventory #57.