[Feature] Add project-scoped Theme Airlock trust

[Codercise]

WHY are these changes introduced?

Theme commands can fall back to a globally remembered store when a project does not specify one. That store is scoped to the developer rather than the theme project, which makes it possible to target the wrong store.

Theme Airlock needs a project-scoped trust model before push and dev can enforce safe target selection.

This is PR 2 of the Theme Airlock safety stack and depends on #8148.

WHAT is this pull request doing?

• Loads trusted stores from the nearest ancestor shopify.theme.toml for the effective theme path.
• Models configured, unconfigured, malformed, duplicate, and normalized trust states.
• Resolves explicit stores, named environments, environment variables, defaults, sole stores, bootstrap candidates, and batches deterministically.
• Fails closed for unknown, malformed, ambiguous, conflicting, empty, and repeated selections.
• Adds authenticated bootstrap and explicit trust writing.
• Preserves TOML comments and serializes concurrent writers with a bounded configuration lock.
• Locks and writes canonical targets when configuration files are symlinked.
• Authenticates before writing first-run trust.

This PR builds the trust foundation only. Push and dev opt into it in PR 3.

Incremental review

Review only the changes introduced by this PR:

Codercise/cli@nh/theme-airlock-atomic-toml...nh/theme-airlock-trust-core

How to test your changes?

pnpm --filter @shopify/theme vitest run \
  src/cli/utilities/theme-airlock/config.test.ts \
  src/cli/utilities/theme-airlock/resolver.test.ts \
  src/cli/utilities/theme-airlock/bootstrap.test.ts \
  src/cli/utilities/theme-airlock/writer.test.ts
pnpm --filter @shopify/theme type-check

Expected: 90 tests pass and type-check passes.

Stack

1. [Feature] Add atomic writes for TOML configuration #8148
2. Project-scoped Theme Airlock trust. This PR.
3. Push and dev protection. Linked after creation.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• This foundation is covered by the Theme Airlock @shopify/theme minor changeset in PR 3