feat(workstation): add mac-defaults validation helper and CI workflow

[Copilot]

The mac-defaults.sh GNOME defaults pack lacked a dedicated contract check, making it impossible to assert the intended desktop behavior slice in CI without a live GNOME session.

Changes

• bin/check-mac-defaults.sh — new read-only helper that inspects mac-defaults.sh source for required settings and emits key=value output. Works without gsettings or a GNOME session.

  mac_defaults_script=present
  hot_corners_disabled=present
  clock_format_12h=present
  locate_pointer_enabled=present
  nautilus_double_click=present
  dock_favorites_seed=present
  files_binding_super_e=present
  terminal_binding_super_ret=present
  screenshot_binding_3=present
  screenshot_binding_4=present
  screenshot_binding_5=present
  screenshot_binding_6=present
  mac_defaults_ok=yes
  

• .github/workflows/workstation-mac-defaults-validation.yml — focused smoke workflow: syntax-checks both scripts, asserts all keys are emitted, and asserts all required settings report =present with mac_defaults_ok=yes. Scoped to paths that affect this lane.

• gnome/README.md — adds a Mac-defaults validation section documenting the helper, emitted keys, and the CI workflow it's wired into.

No changes to mac-defaults.sh, keybindings, or any other scripts.