Move App Doctor route authentication review to the agent

[lopez-mar]

WHY are these changes introduced?

The deterministic route-auth check treats an unrecognized authentication spelling as a vulnerability. Valid load-context, dependency-injection, and middleware patterns can therefore produce false positives, while matching authentication text does not prove it protects the operation.

WHAT is this pull request doing?

Move UNAUTHENTICATED_ENDPOINT to agentic-only review and strengthen its prompt to trace the real verification path before protected operations. Preserve the check's identity and unresolved agent execution until a review is reported; deterministic-only scans no longer claim this check ran.

Remove the obsolete matcher and its tests, add a scan-to-review handoff regression, and update the catalog, embedded prompts, and deterministic-only guidance. Authentication review still requires a coding agent; this does not depend on the new agent loop in #8591.

How to manually test your changes?

pnpm shopify app doctor --path /path/to/react-router-app --json --skip-instructions
pnpm shopify app doctor instructions --path /path/to/react-router-app

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing and includes a patch changeset.