fix: exclude the dyld shared cache from macOS value scans

[JeanExtreme002]

Problem

On macOS, every value/pattern scan walked the dyld shared cache — the ~5.8 GB of read-only library text/data the kernel maps into every process. Linux and Windows already exclude their equivalent file-backed/shared library mappings via default_scan_filter, but on macOS the filter excluded nothing: it relies on MemoryRegion.is_shared, which on macOS reads the shared flag of vm_region_basic_info_64 — and that flag reports FALSE for the shared cache.

Measured on a real process (current Python interpreter under pytest):

	bytes a default scan walks
All readable regions	6.59 GB
Marked is_shared (before)	0 GB

So the pure-Python scan loop chewed through ~6.6 GB on macOS versus ~1 GB on the other platforms — making scans (and the CI test suite, which runs without the NumPy fast path) 4-6x slower: ~15-25 min on macOS vs ~4-6 min on Linux/Windows.

The three offending regions (2176 / 2016 / 1632 MB here) all carry vm_region_extended_info.user_tag == VM_MEMORY_SHARED_PMAP (32) — the kernel's identifier for the shared-cache submap. The private heap regions we do want to scan carry malloc tags instead.

Fix

Recognize the shared cache by its user_tag (read via a VM_REGION_EXTENDED_INFO query, since the basic-info struct has no tag) and mark those regions as is_shared, so default_scan_filter drops them — matching the Linux/Win32 exclusion of file-backed library mappings.

• macos/types.py — add the vm_region_extended_info struct + VM_REGION_EXTENDED_INFO / VM_MEMORY_SHARED_PMAP constants.
• macos/libsystem.py — generalize the mach_vm_region prototype (info as an opaque pointer) so both basic- and extended-info structs can be passed.
• macos/functions.py — _region_user_tag() reads the tag; _region_is_shared() returns the basic shared flag OR user_tag == VM_MEMORY_SHARED_PMAP. Used by get_memory_regions and _query_region.
• tests/test_macos_protect.py — regression test: the shared cache must be flagged is_shared, and default_scan_filter must exclude it.

Pointer scans and address-list reads are unaffected — they filter on is_readable/is_writable, not is_shared, so the shared cache is still a valid pointer target and a valid explicit-address read.

Results

• Bytes scanned: 6.59 GB → 0.97 GB (~6.7x)
• Real search_by_value: 11.94 s → 1.56 s (7.6x)
• Full macOS suite: ~17 min → ~6 min (parity with Linux/Windows)
• 346 passed, 13 skipped; flake8 and mypy clean.