Require evidence for App Security OAuth scope findings

[lopez-mar]

WHY are these changes introduced?

The OAuth-scope prompt treats missing local API references as evidence of excessive access. That can flag planned features, optional scopes, generated queries, and usage outside the reviewed directory without establishing a security problem. It also conflates local scope declarations with effective grants and unauthorized API access.

WHAT is this pull request doing?

Require concrete excess-authority evidence for SCOPE_OVER_REQUEST findings. Trace supported feature paths and exact API scope requirements, distinguish declared/requested/granted access, and keep incomplete evidence unresolved. Least-privilege cleanup remains useful guidance without automatically becoming a high-severity finding.

Update the versioned prompt, catalog guidance, and embedded source. This is independent of the route-auth cutover and #8591; it does not change finding or trace schemas.

How to manually test your changes?

pnpm shopify app security check --path /path/to/app --json --skip-instructions
pnpm shopify app security instructions --path /path/to/app

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing and includes a patch changeset.