owncloud: extend skill from read-only audit to full occ management

Layer gated admin writes onto the read-only GPS-audit skill, driven through
occ over SSH (same paramiko/vault/filecache plumbing):

- user lifecycle (add/delete/enable/disable/reset-password/modify), quota
  get/set/reset, groups (create/delete/members), read-only share listing
  (from oc_share; occ has no share create/list), apps, system config,
  maintenance mode, files scan, ownership transfer, trashbin/versions cleanup.
- All writes gated behind --confirm (refuse -> rc 3); hard-fail guards (rc 2)
  for invalid uid, missing password, and all-users cleanup with no target.
- --all-users trashbin/versions purge now ALSO requires --force-all-users in
  addition to --confirm, so a single stray --confirm cannot trigger an
  irreversible fleet-wide purge.

Built against the verified live occ surface (occ list / occ help), not guessed
flags. Fixes from code-review + security-review: Python-side share filtering
(no MySQL SQL-injection via '' -doubling), occ reads no longer mask a failed
read as healthy (maintenance/quota/config), guarded json.loads, clean --json
output, and '--' end-of-options guards so dash-leading uids can't be parsed as
occ flags. dry_test.sh added as a non-destructive regression harness (43 checks).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/skills/owncloud/SKILL.md

@@ -68,8 +68,10 @@ py "$OWNCLOUD" config-set <name> --value V [--type string|integer|double|boolean
 # files admin
 py "$OWNCLOUD" files-scan (--user jdoe | --all) [--path sub/dir] --confirm
 py "$OWNCLOUD" transfer-ownership <src> <dst> [--path folder] --confirm
-py "$OWNCLOUD" trashbin-cleanup (--user jdoe ... | --all-users) --confirm
-py "$OWNCLOUD" versions-cleanup (--user jdoe ... | --all-users) --confirm
+py "$OWNCLOUD" trashbin-cleanup --user jdoe --confirm
+py "$OWNCLOUD" versions-cleanup --user jdoe --confirm
+# fleet-wide purge needs the extra ack flag on top of --confirm:
+py "$OWNCLOUD" versions-cleanup --all-users --force-all-users --confirm
 ```
 
 ### Passwords + the credential rule
@@ -90,6 +92,9 @@ line (suggested path `infrastructure/owncloud-users/<uid>.sops.yaml`).
 - `trashbin-cleanup` / `versions-cleanup` with **no** `--user` and **no**
   `--all-users` -> **hard-fail exit 2** (occ treats "no user" as *every* user; a
   fleet-wide purge must be made explicit with `--all-users`).
+- `--all-users` on those two also **hard-fails exit 2** unless
+  `--force-all-users` is passed **in addition to** `--confirm` - a single stray
+  `--confirm` must never be enough to irreversibly purge every user's history.
 - invalid uid on `user-add` -> **exit 2**.
 
 ## Access channel