Add breaking change detection CI check

Adds a new 'major-change-check' job to the PR workflow that detects
potential breaking changes by comparing the branch against main:

1. Changesets requesting a major version bump
2. OCLIF manifest: removed commands, flags, or flag env vars
3. Zod schemas: removed fields in app/extension config specifications

When breaking changes are detected:
- A sticky PR comment is posted pinging @Shopify/dev_experience to
  coordinate inclusion in the next major release
- The check fails (red) until a dev_experience team member approves
  the workflow run via the 'breaking-change-approval' environment gate
- Comment links to #help-dev-platform for coordinating major releases

When no breaking changes are found, any stale sticky comment from a
previous run is deleted.

Author: alfonso-noriega

.github/workflows/tests-pr.yml

@@ -287,3 +287,53 @@ jobs:
           header: Type-diff
           message: ${{ steps.type-diff.outputs.report }}
           recreate: true
+
+  major-change-check:
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    name: 'Breaking change detection'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    outputs:
+      has_breaking_changes: ${{ steps.check.outputs.has_breaking_changes }}
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name || github.event.repository.full_name }}
+          ref: ${{ github.event.pull_request.head.ref || github.event.merge_group.head_ref }}
+          fetch-depth: 1
+      - name: Setup deps
+        uses: ./.github/actions/setup-cli-deps
+        with:
+          node-version: ${{ env.DEFAULT_NODE_VERSION }}
+      - name: Build
+        run: pnpm nx run-many --all --skip-nx-cache --target=build --output-style=stream
+      - name: Check for breaking changes
+        id: check
+        run: node workspace/src/major-change-check.js
+      - uses: marocchino/sticky-pull-request-comment@fcf6fe9e4a0409cd9316a5011435be0f3327f1e1 # v2.3.1
+        if: steps.check.outputs.has_breaking_changes == 'true'
+        with:
+          header: Breaking-change-detection
+          message: ${{ steps.check.outputs.report }}
+          recreate: true
+      - uses: marocchino/sticky-pull-request-comment@fcf6fe9e4a0409cd9316a5011435be0f3327f1e1 # v2.3.1
+        if: steps.check.outputs.has_breaking_changes != 'true'
+        with:
+          header: Breaking-change-detection
+          delete: true
+      - name: Fail if breaking changes detected
+        if: steps.check.outputs.has_breaking_changes == 'true'
+        run: |
+          echo '::error::Breaking changes detected. A member of @shopify/dev_experience must approve the breaking-change-approval environment.'
+          exit 1
+
+  major-change-approval:
+    name: 'Breaking change approval'
+    needs: major-change-check
+    if: always() && needs.major-change-check.outputs.has_breaking_changes == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    environment: breaking-change-approval
+    steps:
+      - name: Approved
+        run: echo '✅ Breaking changes approved by dev_experience team member'

.gitignore

@@ -206,3 +206,4 @@ packages/cli-kit/src/cli/api/graphql/*/*_schema.graphql
 
 # Local dev alias scripts
 bin/p
+