Add breaking change detection CI check

Adds a new 'major-change-check' job to the PR workflow that detects
potential breaking changes by comparing the branch against main:

1. Changesets requesting a major version bump
2. OCLIF manifest: removed commands, flags, or flag env vars
3. Zod schemas: removed fields in app/extension config specifications

When breaking changes are detected:
- A sticky PR comment is posted pinging @Shopify/dev_experience to
  coordinate inclusion in the next major release
- The check fails (red) until a dev_experience team member approves
  the workflow run via the 'breaking-change-approval' environment gate

Author: alfonso-noriega

.github/workflows/tests-pr.yml

@@ -287,3 +287,45 @@ jobs:
           header: Type-diff
           message: ${{ steps.type-diff.outputs.report }}
           recreate: true
+
+  major-change-check:
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    name: 'Breaking change detection'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    outputs:
+      has_breaking_changes: ${{ steps.breaking-changes.outputs.has_breaking_changes }}
+      report: ${{ steps.breaking-changes.outputs.report }}
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name || github.event.repository.full_name }}
+          ref: ${{ github.event.pull_request.head.ref || github.event.merge_group.head_ref }}
+          fetch-depth: 1
+      - name: Setup deps
+        uses: ./.github/actions/setup-cli-deps
+        with:
+          node-version: ${{ env.DEFAULT_NODE_VERSION }}
+      - name: Build
+        run: pnpm nx run-many --all --skip-nx-cache --target=build --output-style=stream
+      - name: Check for breaking changes
+        working-directory: workspace
+        id: breaking-changes
+        run: pnpm nx run major-change-check
+      - uses: marocchino/sticky-pull-request-comment@fcf6fe9e4a0409cd9316a5011435be0f3327f1e1 # v2.3.1
+        if: always() && steps.breaking-changes.outputs.report != ''
+        with:
+          header: Breaking-change-detection
+          message: ${{ steps.breaking-changes.outputs.report }}
+          recreate: true
+
+  major-change-approval:
+    name: 'Breaking change approval'
+    needs: major-change-check
+    if: always() && needs.major-change-check.outputs.has_breaking_changes == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    environment: breaking-change-approval
+    steps:
+      - name: Approved
+        run: echo '✅ Breaking changes approved by dev_experience team member'

workspace/project.json

@@ -21,6 +21,14 @@
         "commands": ["node src/type-diff.js"],
         "cwd": "workspace"
       }
+    },
+    "major-change-check": {
+      "executor": "nx:run-commands",
+      "dependsOn": ["^build"],
+      "options": {
+        "commands": ["node src/major-change-check.js"],
+        "cwd": "workspace"
+      }
     }
   }
 }