fix(crush): stop walking macOS-protected directories on first launch

The crush provider's auto-detection walked $HOME and ~/Documents up to
four levels deep looking for `.crush/crush.db`. On macOS that path
crosses into ~/Pictures/Photos Library.photoslibrary (Photo Library
TCC prompt) and, when iCloud Desktop & Documents Sync is enabled,
into iCloud-managed ~/Desktop and ~/Documents (iCloud Drive TCC
prompt). Both popped on every launch.

Two changes:

1. Drop $HOME and ~/Documents from the default search roots. The
   remaining defaults (~/code, ~/src, ~/workspace, ~/dev, ~/Projects,
   ~/projects, ~/Workspace) cover the conventional code-checkout
   locations without crossing into user-data territory. Users who
   keep crush projects elsewhere can point OPENUSAGE_CRUSH_ROOTS or
   the per-account `search_roots` at the specific directory.

2. Extend `isSkippableDirName` with Library, Pictures, Movies, Music,
   Desktop, Public, Applications, .Trash, and any *.photoslibrary
   bundle. This is defense in depth -- even if a user opts into a
   broad root via OPENUSAGE_CRUSH_ROOTS=$HOME, the walker now skips
   the dirs that would trigger TCC.

New `paths_test.go` pins the default-root and skip-list invariants so
neither can regress quietly. Provider doc is updated to explain the
exclusion and the override path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>