Defer context-based route authentication to agent review

[lopez-mar]

WHY are these changes introduced?

Partners using context.shopify.authenticate.admin(request) receive missing-authentication findings because the existing template heuristic does not recognize that wiring. Recognizing the spelling does not prove that verification protects the operation, and maintaining a custom authentication analyzer is disproportionate to this fix.

WHAT is this pull request doing?

Retain the existing React Router template heuristic. When a handler contains context.shopify.authenticate.admin(...), defer that handler to agent review rather than reporting missing authentication or treating it as verified. Record unresolved coverage and pass the relevant files and guidance through the review pack; retain ordinary heuristic findings in other handlers.

Keep the strengthened agent prompt for context provenance, wrappers, verification order, and failure handling. Remove the custom AST analyzer, its app-level dependency, and parser-specific tests in favor of focused handoff regressions.

This remains a heuristic, not proof of route security. Existing template-heuristic limitations and severity-based blocking behavior are unchanged.

How to manually test your changes?

pnpm shopify app security check --path "$APP_PATH" --json

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add