Events schema blocks app deploys that use legacy OAuth scopes

首先，使用将 access_scopes、read_products 和 use_legacy_install_flow 设置为 true 的应用配置，通过 Shopify CLI 4.7.0 重现该问题。比较 shopify app config validate 与 shopify app deploy --no-release，然后验证对于 legacy OAuth，Events 仍然是可选的，或者其 Product topic 接受所声明的 scope。

Summary

Shopify app deploy is blocked for an established app that uses the legacy OAuth installation flow with per-shop dynamic scope overrides.

The current remote app-config schema requires an Events section with at least one subscription. Adding a Product subscription and declaring read_products passes shopify app config validate, but app-version creation fails with:

Missing scope for event topic: Product (read_products)

This happens with both the documented scopes string and the newer required_scopes array when use_legacy_install_flow = true. Removing the Events section instead fails config validation with [events]: Required.

Reproduction

1. Use Shopify CLI 4.7.0 with an app config containing access_scopes, read_products, and use_legacy_install_flow = true.
2. Add an Events subscription for the Product topic.
3. Run shopify app config validate: the config is valid.
4. Run shopify app deploy --no-release: version creation fails because read_products is allegedly missing.
5. Remove the Events section and validate again: validation fails because Events is required.

The same mandatory-Events schema is received by the repository-pinned CLI 3.94.3.

Expected behavior

Events is a developer-preview feature and should remain optional. Apps using legacy OAuth should be able to deploy without an Events section. Alternatively, if Events is intended to support legacy installation, its topic-scope validator should recognize scopes declared in the app config.

Impact

The app cannot create staging or production app versions without either adopting preview Events and abandoning its existing legacy dynamic-scope flow, or failing app-config validation. This blocks unrelated extension deployments.