Fail closed on ambiguous MobileMe plist matches

[pheidon]

Problem / intent

icloud-cli currently mines ~/Library/Preferences/MobileMeAccounts.plist by walking every nested dictionary and taking the first shape that looks plausible. That is convenient, but it is also order-dependent and can silently bind to the wrong account/device record if Apple changes the cache layout or if multiple matching dictionaries appear.

Acceptance criteria

• Make storage status and devices list reject ambiguous matches instead of returning the first plausible nested dictionary.
• Prefer explicit anchors or a narrow schema path where possible.
• If the cache shape changes, fail closed with a clear unreadable/unsupported-cache error rather than emitting stale data.
• Add fixtures that prove the parser prefers the intended account block and does not accept unrelated nested dictionaries.

Validation commands

bash scripts/ci/run-fast-checks.sh
swift test

Notes

• Keep the command read-only.
• Do not broaden the parser just to rescue old cache shapes unless the shape is documented and tested.

Related

• Depends on / informs Surface handoff parse failures instead of silent empties #82 and Decide whether icloud-cli should grow daemon/helper mode #83.