Add typed JSON output to app security check - #8967

Related to https://github.com/shop/issues-develop/issues/23885

WHY are these changes introduced?

app security check is the last app security command without --json. Its service also rendered output, prompted and set the exit code partway through, so a JSON mode couldn't be added without separating those.

WHAT is this pull request doing?

Adds --json to app security check. A scan returns:

{"status": "success", "valid": true, "app": {…}, "resultsDirectory": "…",
 "deterministicFindingsPath": "…/deterministic-findings.json", "agentChecksPath": "…/agent-checks.json",
 "scope": {"includeDirs": [], "excludes": [], "noGitIgnore": false}, "scanDirectories": [{"directory": "…", "origin": "app-directory"}],
 "agentCheckCount": 36, "blocking": {"level": "none", "blockedCheckCount": 0},
 "instructions": {"content": "<Markdown>", "copied": true}}

• No findings. The result doesn't include them; review --json is the one place findings are reported. valid and blockedCheckCount follow --blocking, with the same rule and exit codes as today.
• Instructions. In a terminal, the instructions prompt is still offered under --json, on stderr. Its choices say that the instructions go into the result. --print-instructions includes them without asking. With --skip-instructions, "Nothing", or --no-input, instructions is left out.
• --list-files --json returns {status, app, scope, scanDirectories, files: [{path}]} with absolute paths.
• Declining "Scan it without app configuration?" prints {"status": "cancelled"} and exits 0. In the terminal it now exits 0 too (commit 4).
• Stderr events. Gathering warnings and the "To skip these prompts next time" tip become events on stderr.

Commits:

1. securityCheck returns a listed, scanned or cancelled outcome, and a presenter in security-check/result.ts renders it, prompts for instructions and sets the exit code. Declining is an outcome of the selection rather than an error. No behaviour change.
2. When the instructions can't be copied to the clipboard, check warns instead of failing: the scan has finished, so the exit code still follows --blocking. The clipboard changeset in Add typed JSON output to app security instructions #8965 covers it.
3. Add --json, and remove the App Security section from the JSON output lint exceptions. The JSON output is covered by Add typed JSON output to app security clean #8963's changeset.
4. Declining "Scan it without app configuration?" in the terminal shows the same message and next step as information and exits 0, instead of failing with exit 1. Without prompts, a missing app configuration still fails. Patch changeset.

How to manually test your changes?

Build once and run the local CLI directly, so nothing else reaches stdout:

pnpm nx build cli
alias shopify-dev="node $PWD/packages/cli/bin/dev.js"

Run these in a real terminal with stdout redirected, so the prompts show while the result goes to the file:

# An app with two app configuration files: the picker and the instructions prompt appear; out.json holds one object
shopify-dev app security check --path <app> --json > out.json; echo "exit $?"; cat out.json

# A directory without app configuration: answer "No" -> {"status": "cancelled"}, exit 0
shopify-dev app security check --path <empty-dir> --json > out.json; echo "exit $?"; cat out.json

# The same in text mode: answer "No" -> an info box with the next step, exit 0
shopify-dev app security check --path <empty-dir>; echo "exit $?"

shopify-dev app security check --path <app> --config <name> --json --list-files
shopify-dev app security check --path <app> --config <name> --json --no-input --blocking low; echo "exit $?"   # valid: false, exit 1 when there are findings

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add