Combine deterministic and agent results in App Security review and submit

[jek]

WHY are these changes introduced?

On main, App Security results only describe a single run. check writes a trace and a review pack, agent findings count only when they're attested against that exact scan, and submit uploads one run's trace. Any rerun invalidates the agent's work, so there's no lasting record of where an app stands that deterministic and agent analysis can each update, and that review and Shopify read the same way.

This PR gives App Security a durable model of an app's status that can be reviewed and refreshed over time.

WHAT is this pull request doing?

• Durable results. Two result files share one versioned schema: deterministic-findings.json, written by every check, and agent-findings.json, written by every record. Each records when and at which commit it was produced. Either can be refreshed without invalidating the other, and reads translate by schema version so later CLI versions can evolve the format.
• Status is derived, not stored. Whenever review or submit runs, the engine combines the results that are present, per check. Agent checks declare precedence: a prefer-agent check uses the agent's result when it's at least as new as the deterministic one, and keeps both when it's older, so refreshing one source never silently hides the other.
• review is the view of that status. It shows each check with active findings, then a summary with counts, coverage, each results file's age and commit, and next steps (fix, refresh the agent review, send feedback). --json exposes the same combined status, --check-id narrows it, and --blocking gates on it.
• submit sends what review shows. Upload schema version 2 carries both sources with the inputs Shopify needs to recompute the same status (per-check statuses, precedence, suppression and times). It excludes source code, file paths, snippets, evidence, finding messages, agent reasoning and reasons, suppression justifications and commit identifiers, and it encourages feedback. The server has to accept schema version 2 for uploads to succeed.

All App Security commands stay hidden, so there's no changeset.

How to manually test your changes?

pnpm shopify app security check --path /path/to/app
pnpm shopify app security record --path /path/to/app < findings.json
pnpm shopify app security review --path /path/to/app
pnpm shopify app security review --path /path/to/app --json
pnpm shopify app security review --path /path/to/app --check-id CREDENTIAL_LOG_LEAKAGE --blocking high
pnpm shopify app security submit --path /path/to/app --dry-run

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add

[jek]

/snapit

[github-actions]

⚠️ Potential Breaking Changes Detected

This PR contains changes that may break the existing contract.

@shopify/dev_experience — this PR contains breaking changes that require coordination for the next major release.

🏳️ Removed Flags

The following flags were removed from existing commands:

Command	Flag
app:security:check	--clean
app:security:check	--findings

🔧 Removed Environment Variables

The following env vars are no longer referenced in command flags:

Env Var	Previously Used By
SHOPIFY_FLAG_APP_SECURITY_FINDINGS	app:security:check --findings