Prepare Hydrogen commands for typed JSON output - #4095

WHY are these changes introduced?

Finite Hydrogen commands need shared schema and error support before exposing reliable JSON results.

WHAT is this pull request doing?

Pin Shopify CLI and CLI Kit to the matching stable release (4.9.0), add shared contracts and real-stream capture, and validate project and disabled-command rules in the command lifecycle so CLI Kit emits standard fatal errors. Expose --no-input through shared flags so prompt and browser-authentication policy remains independent from --json. Use CLI Kit UI helpers directly, keep VM startup in the init hook, and keep JSON diagnostics on stderr.

HOW to test your changes?

pnpm --filter @shopify/cli-hydrogen build
pnpm --filter @shopify/cli-hydrogen typecheck
pnpm --filter @shopify/cli-hydrogen test

Verified CLI 4.9.0 loads the Cloudflare tunnel_provider and tunnel_start hooks from its root plugin. Hydrogen must not register the separate plugin again, which would duplicate tunnels. CPU startup profiling was checked against a built storefront and repeated runs with isolated globals. Built-in imports are restricted to an explicit allowlist without filesystem, network or process access. Like the Vite build that precedes it, this Node profiler runs trusted project code; its fresh VM context is not a security sandbox.

Verified timer behavior with MiniOxygen's actual workerd runtime and Oxygen compatibility date 2025-04-01: both setTimeout and setInterval at module scope fail with "Disallowed operation called within global scope". The profiler intentionally preserves that startup restriction; timers remain valid inside request handlers. Regression tests cover this and denied static/dynamic imports of host I/O built-ins.

Checklist

• I have read the contributing guidelines
• I have considered cross-platform impacts
• I have added a changeset for user-facing changes
• I have added tests
• I have updated the documentation