Allow app security instructions before results exist

[jek]

WHY are these changes introduced?

shopify app security instructions aborts in a fresh app because it requires a results directory, even though the generated standalone workflow starts by running shopify app security check. This prevents the instructions from initiating the workflow they describe.

WHAT is this pull request doing?

Removes the results-directory precondition from instructions and verifies that instructions are delivered before any check results exist. record, review, and clean keep their existing results checks.

Known trade-off: instructions does not validate --client-id; the generated check command validates it when run.

How to manually test your changes?

1. Create a fresh app directory containing shopify.app.toml and no .shopify/app-security/ directory.
2. Run pnpm shopify app security instructions --path <app>.
3. Verify the command exits successfully and prints instructions containing ### 1. Run the scan.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add