[Feature] Add project-scoped Theme Airlock trust

[Codercise]

WHY are these changes introduced?

Theme commands can fall back to a globally remembered store when a project does not specify one. That store is scoped to the developer rather than the theme project, which makes it possible to target the wrong store.

Theme Airlock needs a project-scoped trust model before push and dev can enforce safe target selection.

This is PR 2 of the Theme Airlock safety stack and depends on #8148.

Incremental review

Please review only the changes introduced by this PR:

Codercise/cli@nh/theme-airlock-atomic-toml...nh/theme-airlock-trust-core

WHAT is this pull request doing?

• Loads trusted stores from the nearest ancestor shopify.theme.toml for the effective theme path.
• Never searches sibling directories.
• Models configured, unconfigured, malformed, duplicate, and normalized trust states.
• Resolves explicit stores, named environments, environment variables, defaults, sole stores, bootstrap candidates, and batches deterministically.
• Fails closed for unknown, malformed, ambiguous, conflicting, empty, and repeated selections.
• Rejects malformed environment tables without modifying the configuration.
• Adds dependency-injected authenticated bootstrap primitives.
• Adds comment-preserving and conflict-safe trust writing.
• Serializes concurrent writers with a bounded configuration lock.
• Locks and writes canonical targets when configuration files are symlinked.
• Authenticates before writing first-run trust.

This PR provides the trust foundation only. Push and dev opt into it in #8150.

Review map

• Trust types and configuration loading: theme-airlock/types.ts and theme-airlock/config.ts
• Pure target selection: theme-airlock/resolver.ts
• Authenticated bootstrap primitives: theme-airlock/bootstrap.ts
• Locked configuration updates: theme-airlock/writer.ts
• Behavior matrices and filesystem coverage: adjacent *.test.ts files

How to test your changes?

pnpm --filter @shopify/theme vitest run \
  src/cli/utilities/theme-airlock/config.test.ts \
  src/cli/utilities/theme-airlock/resolver.test.ts \
  src/cli/utilities/theme-airlock/bootstrap.test.ts \
  src/cli/utilities/theme-airlock/writer.test.ts
pnpm --filter @shopify/theme type-check
pnpm --filter @shopify/theme lint

Verified locally at this PR's head:

• 4 test files passed
• 91 tests passed
• Type-check and lint passed

Post-release steps

None.

Stack

1. #8148 Atomic TOML writes.
2. #8149 Project-scoped Theme Airlock trust. This PR.
3. #8150 Push and dev protection.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• This PR is an inert foundation. The user-facing change and @shopify/theme changeset are in #8150.