Polish App Security record and review from stack review feedback

[jek]

WHY are these changes introduced?

Follow-ups agreed in review of #8692 and #8693.

WHAT is this pull request doing?

• Redact record validation errors. Errors quote agent input (check IDs, paths, line values), and a secret there reached the terminal and --json output. The engine now redacts them the same way it redacts stored findings.
• Reject findings review can't read. Check snapshots and indentation make the stored agent-findings.json bigger than the input, so an input under 5 MB could be stored over 5 MB, which review rejects. record now checks the stored size first and rejects the document without replacing the existing file.
• Read the findings file as UTF-8 in PowerShell. Windows PowerShell 5.1 reads a file without a byte order mark in the ANSI code page, so app/café.ts was recorded wrong. The command now uses Get-Content -Raw -Encoding UTF8. The $OutputEncoding note now follows both PowerShell forms, since both pipe text to record. A Windows-only test runs the command through powershell.exe.
• Show unresolved-check finding details with --verbose. Suppressed and superseded findings of unresolved checks are now listed in full, as they already are for passed checks.

How to manually test your changes?

Redacted validation errors. Only record is involved; the document is rejected, so nothing is written.

echo '{"schema_version":1,"checks_executed":[{"check_id":"shpat_0123456789abcdef0123456789abcdef","check_version":1}]}' \
  | shopify app security record --path <app> --json

Expect the error to show shpa[REDACTED:38] instead of the token, in both customSections and details.errors.

Unresolved check details. Record an unresolved check with a suppressed finding, then review it:

echo '{"schema_version":1,"checks_executed":[{"check_id":"CREDENTIAL_LOG_LEAKAGE","check_version":1,"status":"unresolved","reason":{"code":"dynamic_logger","message":"The logger is configured at runtime."}}],"findings":[{"check_id":"CREDENTIAL_LOG_LEAKAGE","check_version":1,"file":"app/routes/orders.tsx","line":12,"message":"The session token is logged.","evidence":[{"file":"app/routes/orders.tsx","line":12,"quote":"console.log(session)"}],"reasoning":"The logged session holds a live access token.","suppression":{"justification":"The logger redacts sessions."}}]}' \
  | shopify app security record --path <app>
shopify app security review --path <app> --check-id CREDENTIAL_LOG_LEAKAGE
shopify app security review --path <app> --check-id CREDENTIAL_LOG_LEAKAGE --verbose

Without --verbose, the unresolved box shows the status and 1 finding suppressed. With --verbose, it also lists the finding: its message, reasoning, evidence and suppression justification.

PowerShell encoding. On Windows PowerShell 5.1, save a findings document as UTF-8 without a byte order mark, with a finding in app/café.ts. Pipe it to record using the command from shopify app security instructions, then run review. Expect the path to show as app/café.ts.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add