Make Photos PhotoKit-first

[jmcte]

Summary

• use bounded PhotoKit reads as the primary Photos logical-asset source
• return identifiers, media facts, dimensions, favorite/hidden state, album membership, and explicit provenance
• avoid pixels, thumbnails, network requests, and implicit iCloud downloads
• retain the existing package walk only as --degraded-filesystem

Governing Issue

Closes #94

Validation

• Relevant local checks passed

• Required PR checks are expected to satisfy CI Gate

• Skipped checks are explained below

• swift test --disable-sandbox (117 tests passed)

• bash scripts/ci/run-fast-checks.sh (passed)

• ./.build/debug/icloud-cli photos authorization --format json (exit 0, denied state, no access request)

No checks skipped.

Bootstrap Governance

• Changes are scoped to the linked issue
• Contributor or PR guidance changes are reflected in CONTRIBUTING.md, .github/PULL_REQUEST_TEMPLATE.md, and docs/bootstrap/onboarding.md when applicable
• PR author enabled auto-merge where GitHub allows it, or GitHub plan-limit evidence/unavailable reason is recorded and the fallback merge-readiness policy applies
• No real secrets, runtime auth, or machine-local env files are committed

No contributor guidance changed. Auto-merge will be enabled after stacked dependencies merge.

Flow Contract

• Owner lane: Hermes native provider
• Repair owner: jmcte
• Autonomy class: bounded implementation
• Risk class: high-sensitivity metadata; read-only

Flow Merge Readiness

• Every blocker has a next actor and next action
• No active blocking requested changes remain
• Non-author approval is present when required
• PR author enabled auto-merge where GitHub allows it, or recorded why it is unavailable/unsafe

Next actor: independent reviewer after #101 and #102 merge.

Merge Automation

• PR author enabled auto-merge with gh pr merge --auto --squash, or the reason it is unavailable/unsafe is noted below

This draft is stacked on the #89 provider manifest and #90 SQLite snapshot foundation. It can be rebased and enabled for auto-merge after those land.

Notes

• PhotoKit does not expose reliable local/cloud availability without attempting a media request, so that fact is explicitly unknown.
• Derived observations are separate from source facts and remain empty; no OCR or classification occurs.

[Hermes-omt]

The exact head passes swift test (117 tests), but this PR must be rebased onto current main before approval. Live main is d7f88dc01bd283b53c55fa59ed63f43f212a50a5; GitHub reports this PR unmergeable/dirty, and a local merge-tree reproduces conflicts in CommandLine.swift, CommandRunner.swift, ProviderManifest.swift, and provider-manifest tests. Resolve the rebase while preserving main's providers external-manifest support and combining this PR's PhotoKit/provider capability changes, then rerun CI on the rebased head.

[Hermes-omt]

Request changes: photos list --photos-library PATH parses and retains PATH, but CommandRunner only uses it inside if options.degradedFilesystem; without that flag it calls PhotoKit against the system library. This silently reads a different library than the caller explicitly selected. Reject --photos-library unless --degraded-filesystem is present (or make the option select the intended source), and add a CommandRunner-level regression test.