[Feature] Protect theme push and dev with Theme Airlock

[Codercise]

WHY are these changes introduced?

theme push and theme dev can currently target the globally remembered store when a project omits --store. A developer moving between client projects can therefore create a theme or upload files to the wrong store before noticing.

Theme Airlock makes project trust a required precondition for those destructive workflows.

This is PR 3 of the Theme Airlock safety stack and depends on #8148 and #8149.

WHAT is this pull request doing?

• Protects theme push and theme dev before authentication, theme selection, creation, checksums, services, or uploads.
• Prevents protected commands from mutating the globally remembered store.
• Validates and authenticates every multi-environment target before any environment starts.
• Reuses approved sessions through push, dev, and metafield pulling.
• Displays the exact environment, store, selection source, explicit or implicit status, and operation before execution.
• Adds authenticated shopify theme airlock add <store> --environment <name> setup.
• Registers the new command in the theme package and generated CLI manifest.
• Propagates protected batch failures after scheduled rendering completes.
• Adds a minor @shopify/theme changeset.

Force and yes flags cannot add trust or bypass a trust decision.

Incremental review

Review only the changes introduced by this PR:

Codercise/cli@nh/theme-airlock-trust-core...nh/theme-airlock-push-dev

How to test your changes?

pnpm --filter @shopify/theme vitest run
pnpm --filter @shopify/theme type-check
pnpm --filter @shopify/theme lint
pnpm changeset status
node packages/cli/bin/dev.js theme airlock add --help

Expected: 73 test files and 837 tests pass. Type-check, lint, changesets, command discovery, and help pass.

Manual proof was also completed against the-bilko-store.myshopify.com:

• Unconfigured push and dev failed with No files were uploaded. and made zero network connections.
• Authenticated trust creation succeeded without changing remembered-store state.
• Trusted unpublished push displayed the expected Airlock preflight and completed.
• Trusted dev displayed the expected Airlock preflight and started successfully.
• The disposable theme was deleted, the previous development theme was restored, and the original remote theme inventory matched after cleanup.

Stack

1. [Feature] Add atomic writes for TOML configuration #8148
2. [Feature] Add project-scoped Theme Airlock trust #8149
3. Protect theme push and dev with Theme Airlock. This PR.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing and includes a minor @shopify/theme changeset