Require recorded scopes to reuse a store auth session in theme commands

[alfonso-noriega]

WHY are these changes introduced?

Second layer of the theme dev store-auth regression fix (Slack thread); stacked on #8183.

hasRequiredStoreAuthScopes treated a stored session with no recorded scopes as satisfying any requirement (if (scopes.length === 0) return true), so theme pull/theme push could adopt sessions whose actual grant is unknown and fail later with missing-scope errors.

WHAT is this pull request doing?

• Removes the empty-scopes escape hatch: a stored session must record scopes that satisfy the command's declared requirements to be reused.
• Both shopify store auth and shopify store create preview always record granted scopes, so an empty scope list means the grant can't be verified — the command now falls back to normal theme authentication instead (graceful, no error).
• Flips the test that pinned the old behavior.

How to test your changes?

Covered by unit tests (theme-command.test.ts): a stored session with scopes: [] no longer satisfies theme pull/theme push; the command falls back to ensureAuthenticatedThemes.

Measuring impact

• Existing analytics will cater for this addition

[alfonso-noriega]

• Log store auth session decisions in theme commands under --verbose #8186
• Skip expired store auth sessions in theme commands #8185
• Require recorded scopes to reuse a store auth session in theme commands #8184 👈 (View in Graphite)
• Make store auth session reuse opt-in per theme command #8183
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

Differences in type declarations

We detected differences in the type declarations generated by Typescript for this branch compared to the baseline ('main' branch). Please, review them to ensure they are backward-compatible. Here are some important things to keep in mind:

• Some seemingly private modules might be re-exported through public modules.
• If the branch is behind main you might see odd diffs, rebase main into this branch.

New type declarations

We found no new type declarations in this PR

Existing type declarations

packages/cli-kit/dist/public/node/api/partners.d.ts

@@ -1,5 +1,7 @@
 import { GraphQLVariables, GraphQLResponse, CacheOptions, UnauthorizedHandler } from './graphql.js';
 import { RequestModeInput } from '../http.js';
+import { Variables } from 'graphql-request';
+import { TypedDocumentNode } from '@graphql-typed-document-node/core';
 /**
  * Executes a GraphQL query against the Partners API.
  *
@@ -12,6 +14,17 @@ import { RequestModeInput } from '../http.js';
  * @returns The response of the query of generic type <T>.
  */
 export declare function partnersRequest<T>(query: string, token: string, variables?: GraphQLVariables, cacheOptions?: CacheOptions, preferredBehaviour?: RequestModeInput, unauthorizedHandler?: UnauthorizedHandler): Promise<T>;
+/**
+ * Executes a GraphQL query against the Partners API. Uses typed documents.
+ *
+ * @param query - GraphQL query to execute.
+ * @param token - Partners token.
+ * @param variables - GraphQL variables to pass to the query.
+ * @param preferredBehaviour - Preferred behaviour for the request.
+ * @param unauthorizedHandler - Optional handler for unauthorized requests.
+ * @returns The response of the query of generic type <TResult>.
+ */
+export declare function partnersRequestDoc<TResult, TVariables extends Variables>(query: TypedDocumentNode<TResult, TVariables>, token: string, variables?: TVariables, preferredBehaviour?: RequestModeInput, unauthorizedHandler?: UnauthorizedHandler): Promise<TResult>;
 /**
  * Sets the next deprecation date from [GraphQL response extensions](https://www.apollographql.com/docs/resources/graphql-glossary/#extensions)
  * if `response.extensions.deprecations` objects contain a `supportedUntilDate` (ISO 8601-formatted string).