Return managed settings whose declaration cannot be safely applied.
A key is a violation when an enforced managed policy declaration cannot be applied, or when a known managed section has a non-table value. The shape cases matter because "wrong shape" is not "absent": merging such a value can erase a user subtree before a reader falls back to a default.
Required rather than defaulted to the process snapshot: managed_health
pairs this with the health of the same snapshot, and a default that
silently read the cache is what let a refreshed status be reported next to
stale violations.
Managed table to inspect. Must come from a snapshot whose
status is usable, since an unhealthy snapshot carries {} and
would report no violations.
Health and display metadata for the same managed snapshot.
