Improve: Restrict environment metadata collection to verified agent fields

[austinjump-sec]

WHY are these changes introduced?

Currently, getShopifyEnvironmentVariables() uses a broad prefix matching pattern (key.startsWith('SHOPIFY_')) to collect system diagnostic metrics. This loose filter inadvertently captures non-telemetry operational configurations—including active local workspace state flags and temporary environment keys—into the core outbound tracking payload object.

Following the definitive architecture roadmap explicitly outlined in the module's code comments, this introduces unnecessary data bloat and noise to our analytics pipelines. Enforcing a strict, precise mapping ensures we align with clean data minimization principles.

WHAT is this pull request doing?

This PR refactors getShopifyEnvironmentVariables() inside packages/cli-kit/src/private/node/analytics.ts.

• Replaces the permissive prefix evaluation string search with an explicit ALLOWED_ANALYTICS_KEYS lookup array.
• Restricts collected metrics data points exclusively to the 5 primary, first-class Monorail agent dimensions listed in the codebase documentation (SHOPIFY_CLI_AGENT, SHOPIFY_CLI_AGENT_VERSION, SHOPIFY_CLI_AGENT_RUN_ID, SHOPIFY_CLI_AGENT_SESSION_ID, and SHOPIFY_CLI_AGENT_PROVIDER).
• Completely prevents unmapped runtime variables from cluttering local execution logs and outgoing analytics hooks.
• Prevents possible sensitive information from reaching a proxy or bad actor

How to test your changes?

1. Open your terminal and populate your local environment with both standard telemetry metrics keys and dummy local variables:

   export SHOPIFY_CLI_AGENT="test-agent"
   export SHOPIFY_CLI_IDENTITY_TOKEN="shpib_mock_secret_token"

2. Build the workspace components locally:

   pnpm --filter cli-kit build

3. Invoke the analytics runner or review the output object from getSensitiveEnvironmentData().
4. Verification: Confirm that the output configuration object strictly bundles the "SHOPIFY_CLI_AGENT" value, while completely omitting the unmapped "SHOPIFY_CLI_IDENTITY_TOKEN" key.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add

[github-actions]

This PR seems inactive. If it's still relevant, please add a comment saying so. Otherwise, take no action.
→ If there's no activity within a week, then a bot will automatically close this.
Thanks for helping to improve Shopify's dev tooling and experience.

[austinjump-sec]

waiting on checks

[github-actions]

This PR seems inactive. If it's still relevant, please add a comment saying so. Otherwise, take no action.
→ If there's no activity within a week, then a bot will automatically close this.
Thanks for helping to improve Shopify's dev tooling and experience.

[austinjump-sec]

waiting on checks