Add static frame-ancestors check to App Doctor

[lopez-mar]

WHY are these changes introduced?

STATIC_FRAME_ANCESTORS already exists as an App Doctor product ID in the agentic pack, but the deterministic engine had no narrow implementation for the literal cases it can prove safely.

WHAT is this pull request doing?

• Adds a deterministic STATIC_FRAME_ANCESTORS runner for embedded admin apps only.
• Introduces a distinct embedded_app capability derived from root embedded = true in shopify.app.toml, separate from theme app-embed blocks.
• Flags only literal wildcard or clearly permissive frame-ancestors tokens inside Content-Security-Policy text.
• Keeps missing-CSP detection and nuanced policy construction in the agentic tier.
• Adds negative fixtures for fixed allowlists, computed policies, non-embedded apps, and theme-only app-embed surfaces.
• Updates JSON fixtures and a patch changeset for the new capability field.

Verification

• pnpm exec vitest run packages/app/src/cli/services/app-doctor-engine/tests/deterministic-rules.test.ts packages/app/src/cli/services/app-doctor-engine/tests/scan-contract.test.ts packages/app/src/cli/services/app-doctor-engine/tests/trace.test.ts packages/app/src/cli/services/app-doctor-json.test.ts packages/app/src/cli/services/doctor-output.test.ts packages/app/src/cli/services/doctor.test.ts
• pnpm --filter @shopify/app type-check
• pnpm --filter @shopify/app lint

[jplhomer]

Couple small questions!

[lopez-mar]

Good questions. appSourceFiles() is intentionally the framework-agnostic app-source boundary for STATIC_FRAME_ANCESTORS; reactRouterFiles() currently delegates to it, but keeping the names separate makes the execution contract explicit because existing source checks remain React Router-gated while the new app_source target is not. I also added regression coverage for headers.set, response.headers.append, res.setHeader, static concatenation, static template literals, and mixed frame-ancestors 'self' * source lists.

[dmerand]

Again, approved from the overall lens of CLI command membership. My agents had a couple of notes about the implementation that may be worth considering.