Q:

Please help me understand this simple arp request / reply - how does a router know an IP address without knowing the MAC address?

I am new to networking, I am using Wireshark on my home PC to learn about ARP. I understand that ARP is used to build the ARP cache, which correlates IP addresses to MAC addresses on a LAN. ARP messages are L2.
I saw the following two frames.
 [ ARP Request ] - who has 192.168.1.66 - Tell 192.168.1.254 [GW]

    - Eth: 
            Destination: Micro-St_6d:ea:0c [BOB'S PC]    
            Source: Sagemcom_0c:6b:29   [GW]

My understanding:   Arp request from my Default Gateways MAC asking "Reply with your MAC if you have Bob's IP."
[ ARP Response] - 192.168.1.66 is at 4C-CC-6A-6D-EA-0C

    - Eth:  
           Destination: Sagemcom_0c:6b:29 [GW]
           Source: Micro-St_6d:ea:0c    [BOB'S PC]

My understanding: ARP response from Bob's PC saying "this IP is me - here is my MAC"
My questions:

Why is the destination field in in the arp request directly to Bob's
PC? How did it know this was the correct destination? And why is it
asking if it seems to know? A broadcast would have a destination of
all F's right?
More generally to ARP: How does the Default Gateway get to a
position where it knows an IP, but doesn't know a MAC? I understand
they operate on different layers, but wouldn't it have needed L2 to
pass on that information at some point?

A:

Why is the destination field in in the arp request directly to Bob's PC? How did it know this was the correct destination? And why is it asking if it seems to know? A broadcast would have a destination of all F's right?

Right. So it already knew and was just confirming that it was still the case. You don't want to cache ARP entries forever because networks can change. But there's no reason to use a broadcast and disturb every computer in the network when you're 99.9% sure which computer you want to talk to.

More generally to ARP: How does the Default Gateway get to a position where it knows an IP, but doesn't know a MAC? I understand they operate on different layers, but wouldn't it have needed L2 to pass on that information at some point?

Consider a typical SoHo router set to forward port 8000 to 192.168.1.7 -- when it gets an inbound packet from the WAN sent to port 8000, it needs to rewrite the destination IP address to 192.168.1.7 and send the packet on to the machine with that IP address. How should it know what MAC destination address to use?
That's about the only case for a typical SoHo router because other than port forwarding (and a few other rare edge cases such as a DNS or NTP server being local), they don't initiate communication with LAN devices that haven't talked to them. Nevertheless, they will still confirm the IP to MAC mapping periodically.

