fix: make the suggest/permissions/datasafety/list guards actually run

[arena-ai-coding-agent]

Problem

Four methods guard their required option with && where || is meant:

if (!opts && !opts.appId) { throw Error('appId missing') }

!opts && !opts.appId can only be true when there is no options object — and in that case reading opts.appId blows up first. So the documented error can never escape and callers get an internals-leaking TypeError instead. Reproducible on main with no network access needed (the guard runs before the request):

call	on main	expected
gplay.suggest()	TypeError: Cannot read properties of undefined (reading 'term')	Error: term missing
gplay.permissions()	TypeError: ... (reading 'appId')	Error: appId missing
gplay.datasafety()	TypeError: ... (reading 'appId')	Error: appId missing
gplay.list()	TypeError: ... (reading 'category')	the default TOP_FREE/APPLICATION list
gplay.suggest({})	no error: fires a batchexecute request for the literal term undefined	Error: term missing

list() is the worse one of the five: every option is documented as optional ("collection (optional, defaults to collection.TOP_FREE)", "category (optional, defaults to no category)"), yet the README-documented gplay.list() throws, because validate(opts) runs on the raw argument before the defaults are merged in. As a side effect validate() also wrote category/collection into the caller's options object.

app(), search(), reviews() and similar() already use the !opts || form — this lines the remaining ones up with them.

Fix

• lib/suggest.js, lib/permissions.js, lib/datasafety.js: !opts && !opts.x → !opts || !opts.x, so the guard covers both "no object" and "empty object".
• lib/list.js: merge the defaults into fullListOpts first and validate that, then use it for the request options, the throttle and parseCollectionApps as well (the caller's object is no longer mutated, and fullDetail lookups inherit the same lang/country/cache defaults as the list request itself).

Errors keep being raised inside the promise executor, so they stay rejections (same as the existing Invalid category / Invalid sort assertions in the suite) and no method's resolved value changes.

Testing

New regression tests in test/lib.suggest.js, test/lib.permissions.js, test/lib.datasafety.js and test/lib.list.js. The seven validation ones all fail on main and pass here; they need no network, so they are not subject to Play flakiness:

  Suggest method
    ✔ should throw a "term missing" error when the term is not given
    ✔ should throw a "term missing" error when no options are given
  Permissions method
    ✔ should throw an "appId missing" error when the appId is not given
    ✔ should throw an "appId missing" error when no options are given
  Data Safety method
    ✔ should throw an "appId missing" error when the appId is not given
    ✔ should throw an "appId missing" error when no options are given
  List method
    ✔ should not mutate the options object given by the caller
    ✔ should not need any option to fetch the default collection   (live)

• npm run lint clean; npm test otherwise unchanged.
• Deliberately not included: developer() has the same if (!opts.devId) pattern, but fix: don't crash when a developer page has no app list section facundoolano/google-play-scraper#759 is already touching that file — happy to add it here if that one is not merged, or the maintainer can pick it up there.
• The last commit is a chore(deps) lockfile/overrides refresh, not part of this fix: npm audit (a required CI step) is red on main for every PR regardless of content, so it is included to keep CI green. Drop it / rebase once fix: resolve all npm audit findings via dependency overrides (CI audit step red) facundoolano/google-play-scraper#762 lands.