Fix theme dev 502s on storefront responses with large headers

[rjmcgee53192]

WHY are these changes introduced?

Fixes #8717

shopify theme dev renders every page as a 502 once the browser has cookies for the store: the storefront's response header block (a large Set-Cookie collection) exceeds the header-size cap of Node's bundled fetch, the resulting UND_ERR_HEADERS_OVERFLOW is wrapped in a generic TypeError: fetch failed, and the proxy surfaces a bare 502. The CLI pinned no header limit of its own, so the effective cap was whatever the Node version under it happened to default to that release.

WHAT is this pull request doing?

Pins a 128 KiB header-size cap explicitly for theme dev, on both hops the issue maps:

• A new storefront-fetch utility in @shopify/theme creates an undici Agent with maxHeaderSize of 128 KiB and installs it as the global fetch dispatcher when a dev server starts. The storefront proxy and renderer both use the global fetch, so this covers every upstream storefront request without changing those call sites. 128 KiB matches the largest mainstream CDN header ceiling and covers the measured failing responses (~40 KB and up) with headroom; it stays an upper-bound check, not a preallocated buffer.
• The local dev servers (theme and theme-extension) are created with the same maxHeaderSize, so the request side stops failing once the browser's cookie jar for the local origin — which accumulates the storefront's cookies — grows past Node's default request-header cap.
• extractFetchErrorInfo now walks the error's cause chain and surfaces the first code it finds (for example UND_ERR_HEADERS_OVERFLOW) in the headline shown on the 502 page, instead of only the wrapped fetch failed message. This failure took a NODE_OPTIONS fetch shim to diagnose; the next one shouldn't.

Adds undici@7.28.0 as a direct dependency of @shopify/theme (already present in the workspace lockfile) and a patch changeset for @shopify/theme.

How to manually test your changes?

1. Run shopify theme dev against a store whose storefront sets a large Set-Cookie collection on cookie'd requests (the reporter's case: a Plus storefront, response header block over ~40 KB), using a browser that already has cookies for the store.
2. Before this change every page renders "Failed to render storefront with status 502 (Bad Gateway)"; after it, pages render normally.
3. A synthetic check also works: point the dev proxy path at any local origin that replies with more than 16 KiB of Set-Cookie headers and confirm the page loads, and that a deliberately broken upstream now shows a Cause: … line with the underlying error code on the 502 page.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add

Note on pnpm-lock.yaml

The lockfile update for this change is a 3-line addition (the undici importer entry for @shopify/theme, specifier/version 7.28.0; undici 7.28.0 is already present in the lockfile's packages section). It will land as a follow-up commit on this branch shortly.

[rjmcgee53192]

signed