feat: inspect running app interaction options (#42)

[bigduu]

Inspecting a running Electron/Chromium application previously required knowing how to locate its debugging endpoint. Nova now exposes one read-only inspect_app operation: callers pass an application name or bundle ID, or omit it to discover running Chromium candidates. Process ownership, profile evidence and bounded CDP metadata checks remain internal; detailed diagnostics are opt-in.

Summary

• Identify running macOS Chromium/Electron/CEF applications from bundle evidence even when no debugging listener is exposed; preserve explicit unknown/incomplete states.
• Probe only app-owned local candidates, with bounded time/work, no proxy or redirect following, and process-identity rechecks. Distinguish browser-level handshake evidence from Node inspector and full tool compatibility.
• Return a concise application status and existing native interaction route. The operation does not launch, focus, quit, authorize, attach to, or read page content from an application.
• Preserve existing native/browser tools and make discovery optional. Attachment and automatic provider routing remain separate work under [nova] feat: track independent app permissions and interaction UX Zenith#185 and [nova] feat: attach existing Chromium apps through explicit local CDP endpoints #41.

Test Plan

• cargo fmt --all -- --check, git diff --check, complete cargo metadata --locked --format-version 1.
• Strict macOS and aarch64 Windows all-target Clippy passed (Windows compile validation, not native Windows execution).
• Safe Rust suite: 122 library, 3 CLI, 3 managed MCP and 2 launcher tests passed. Test-owned macOS listener/process identity opt-in passed.
• Chrome extension: 122 passed; native host: 30 passed; release/static/tag/mock App checks passed.
• Independently prepared Electron 44.2.0 / Chromium 152.0.7977.76 app tested at this exact commit, using a unique bundle ID and temporary profile. Both no-CDP and internally enabled random-port phases passed; the app remained alive after inspection. Default output privacy, wrong-parameter rejection, process reuse/ownership changes, IPv6, stale profile evidence, redirects, incompatible/Node endpoints and slow HTTP/WS streams have fixture coverage.
• Legacy local App/stdio tests that run permission-requesting startup are left to isolated CI. This does not claim signed distribution, TCC upgrade persistence, actual CDP page interaction or full Electron tool compatibility.

No graphical UI is changed. README includes the compact API examples; raw endpoint/process details are not required inputs.

Closes #42.

[bigduu]

Independent agent review approved commit 159af8e177cdf475c0b3dd5319727e95dc842314 against base 8f029d22dbc9ab317a68560788d1e6360b71120e.

Reviewer: bodhi_nova_boundary (separate agent; no implementation edits). Read all 14 changed files, the live Issue #42 acceptance criteria, dependency changes, fixtures and final verification logs. No introduced or acceptance-blocking findings; no new adjacent issues identified.

The review checked the single optional inspect_app interface, runtime evidence and helper deduplication, UID/PID/start-time/executable/listener ownership checks, strict same-address/port loopback metadata probing, redirect/proxy rejection, resource deadlines and size limits, concise default output, and separation of handshake evidence from attachment/authorization/tool compatibility. The implementation remains the bounded Nova-only discovery slice.

The exact commit passed both real, test-owned Electron 44.2.0 acceptance phases: the app remains discoverable without a debugging endpoint; when the app internally enables a random debugging port, Nova verifies the browser handshake without an OS-argv port flag. Both phases left the application running. The reviewer inspected these final logs and the safe Rust suite, own-listener test and macOS/Windows cross-check logs.

Root verification: all six CI jobs for this commit succeeded in run 33949545136. The live head/base match the reviewed commit, the PR is clean and mergeable, there are no review threads or requested changes, and Issue #42 is open and claimed.