[Feature] Add atomic writes for TOML configuration

[Codercise]

WHY are these changes introduced?

Theme Airlock needs to update project trust without risking a partially written or corrupted shopify.theme.toml. Existing TomlFile mutations write directly to the destination path.

This is PR 1 of the Theme Airlock safety stack.

WHAT is this pull request doing?

• Adds a public writeFileAtomically filesystem utility using a unique sibling file and native rename.
• Creates temporary siblings with 0600 permissions.
• Leaves newly created destinations at 0600.
• Preserves the existing mode when replacing a file.
• Preserves the primary write error if temporary-file cleanup also fails.
• Writes through canonical symlink targets without replacing symlinks.
• Rejects dangling symlinks without modifying them.
• Uses atomic writes for every TomlFile mutation path.
• Adds a minor @shopify/cli-kit changeset.

This changes the write behavior of TomlFile callers across Shopify CLI packages, not only Theme Airlock.

Review map

• Atomic filesystem behavior: packages/cli-kit/src/public/node/fs.ts
• Atomic TOML integration: packages/cli-kit/src/public/node/toml/toml-file.ts
• Filesystem and permission coverage: packages/cli-kit/src/public/node/fs.test.ts
• TOML rollback coverage: packages/cli-kit/src/public/node/toml/toml-file.test.ts

How to test your changes?

pnpm --filter @shopify/cli-kit vitest run \
  src/public/node/fs.test.ts \
  src/public/node/toml/toml-file.test.ts
pnpm --filter @shopify/cli-kit type-check
pnpm --filter @shopify/cli-kit lint

Verified locally:

• 2 test files passed
• 66 tests passed
• 1 Windows-only permission test skipped
• Type-check and lint passed

Post-release steps

None.

Stack

1. #8148 Atomic TOML writes. This PR.
2. #8149 Project-scoped Theme Airlock trust.
3. #8150 Push and dev protection.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing: I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add