Remove the App Security submit command

[jek]

WHY are these changes introduced?

app security submit is hidden and has never been released. Removing it before release leaves the CLI with no upload path or payload contract to maintain.

WHAT is this pull request doing?

Removes app security submit and everything only it used, keeping the shared results loader and combination that review renders.

• review and the agent instructions no longer point at submit. When there's nothing left to suggest, review leaves out the next steps section instead of showing an empty heading.
• clean no longer removes submission.json.
• The combination rules are documented on their own terms, now that no server recomputes them from an upload.
• The source scan upload mutations come out of the developer platform client, and uploadToGCS goes back to the file path signature that deploy and dev use.

All App Security commands stay hidden, so there's no changeset.

How to manually test your changes?

pnpm shopify app security check --path /path/to/app
pnpm shopify app security review --path /path/to/app
pnpm shopify app security instructions --path /path/to/app
pnpm shopify app security clean --path /path/to/app
pnpm shopify app security submit --path /path/to/app

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add

[github-actions]

⚠️ Potential Breaking Changes Detected

This PR contains changes that may break the existing contract.

@shopify/dev_experience — this PR contains breaking changes that require coordination for the next major release.

🗑️ Removed Commands

The following commands were removed from the OCLIF manifest:

• app:security:submit

🏳️ Removed Flags

The following flags were removed from existing commands:

Command	Flag
app:security:check	--clean
app:security:check	--findings

🔧 Removed Environment Variables

The following env vars are no longer referenced in command flags:

Env Var	Previously Used By
SHOPIFY_FLAG_APP_SECURITY_FINDINGS	app:security:check --findings
SHOPIFY_FLAG_APP_SECURITY_DRY_RUN	app:security:submit --dry-run
SHOPIFY_FLAG_APP_SECURITY_FEEDBACK	app:security:submit --feedback