[iamnbutler]

Adds the system-state reads, as agreed. No new tool: desktop_apps gains a top-level system object.

• focus
  • frontmost app pid, bundle_id and name, plus its frontmost window_id;
  • the focused element: role, title, identifier, bounds and window_id. The value is never included.
  • The element read uses Peekaboo's existing getFocusedElement bridge op, now in the runtime allowlist. No patch is needed.
• appearance: mode (effective dark or light), switches_automatically, accent_color, increase_contrast, reduce_motion, reduce_transparency, invert_colors, differentiate_without_color.
• session: locked, on_console, screensaver_running, displays_asleep, secure_keyboard_entry.
• input: keyboard_layout (input source id and name), and pointer position with display_index.
• menu_bar_autohides and dock_autohides.
• warnings and note.

Budget guard: the focused-element read runs after the inventory and is raced against its own 300 ms limit in the client. The host side also has 0.25 s and 0.05 s AX messaging timeouts.

• A late or failed read leaves focus.element null, with a warning.
• A runtime without the op gets a warning and skips the read entirely.
• Everything else is read in the client process without Accessibility.

Not reported: Focus modes such as Do Not Disturb have no public read, so they're left out.

Live check (signed dev host, screen locked):

• apps took 0.20–0.23 s end to end with 160 apps, and system was 1,060 bytes.
• Values read: dark mode; locked true, on_console true; Canadian layout; Dock autohide on.
• Focus was loginwindow, with element AXWindow "Login" and identifier login. Its window_id came from the element, because the login window isn't a normal-level window.
• The 300 ms timeout path isn't exercised live.

Updated: docs (docs/tools.md) and the desktop_apps description.