[Feature] Add atomic writes for TOML configuration

[Codercise]

WHY are these changes introduced?

Theme Airlock needs to update project trust without risking a partially written or corrupted shopify.theme.toml. Existing TomlFile mutations write directly to the destination path.

This is PR 1 of the Theme Airlock safety stack.

WHAT is this pull request doing?

• Adds a public writeFileAtomically filesystem utility using a unique sibling file and native rename.
• Creates temporary files with restrictive permissions and preserves existing file modes.
• Writes through canonical symlink targets without replacing symlinks.
• Rejects dangling symlinks without modifying them.
• Uses atomic writes for every TomlFile mutation path.
• Adds a minor @shopify/cli-kit changeset.

How to test your changes?

pnpm --filter @shopify/cli-kit vitest run src/public/node/fs.test.ts src/public/node/toml/toml-file.test.ts
pnpm --filter @shopify/cli-kit type-check

Expected: 64 tests pass, with 1 Windows-only skip, and type-check passes.

Stack

1. Atomic TOML writes. This PR.
2. Project-scoped Theme Airlock trust. Linked after creation.
3. Push and dev protection. Linked after creation.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing and includes a minor @shopify/cli-kit changeset