[Bug]: CLI removes existing access scopes when running shopify app dev

[metatick]

Please confirm that you have:

• Searched existing issues to see if your issue is a duplicate. (If you’ve found a duplicate issue, feel free to add additional information in a comment on it.)
• Reproduced the issue in the latest CLI version.

In which of these areas are you experiencing a problem?

App

Expected behavior

An existing dev store installation's app scopes should be left alone if access scopes are not declared in shopify.app.toml

Actual behavior

Each time shopfiy app dev is run, existing access scopes are removed from the dev store, which requires re-authorization through oauth.

This is time consuming and can lead to confusion in some cases.

Eg. multiple developers working at the same time, one runs shopify app dev and the other starts seeing graphql requests fail due to missing scopes.

Perhaps this should be either configurable in shopify.app.toml, or an opt-in flag for the app dev command.

Verbose output

N/A

Reproduction steps

1. Have an existing App that uses oauth to request access scopes installed on a development store
2. Run shopfiy app dev
3. Observe that the app no longer has the access scopes it had prior to running shopify app dev

Operating System

N/A

Shopify CLI version (shopify --version)

3.85.5

Shell

No response

Node version (run node -v if you're not sure)

22.19.0

What language and version are you using in your application?

No response