Events schema blocks app deploys that use legacy OAuth scopes

Summary

Shopify app deploy is blocked for an established app that uses the legacy OAuth installation flow with per-shop dynamic scope overrides.

The current remote app-config schema requires an Events section with at least one subscription. Adding a Product subscription and declaring read_products passes shopify app config validate, but app-version creation fails with:

Missing scope for event topic: Product (read_products)

This happens with both the documented scopes string and the newer required_scopes array when use_legacy_install_flow = true. Removing the Events section instead fails config validation with [events]: Required.

Reproduction

1. Use Shopify CLI 4.7.0 with an app config containing access_scopes, read_products, and use_legacy_install_flow = true.
2. Add an Events subscription for the Product topic.
3. Run shopify app config validate: the config is valid.
4. Run shopify app deploy --no-release: version creation fails because read_products is allegedly missing.
5. Remove the Events section and validate again: validation fails because Events is required.

The same mandatory-Events schema is received by the repository-pinned CLI 3.94.3.

Expected behavior

Events is a developer-preview feature and should remain optional. Apps using legacy OAuth should be able to deploy without an Events section. Alternatively, if Events is intended to support legacy installation, its topic-scope validator should recognize scopes declared in the app config.

Impact

The app cannot create staging or production app versions without either adopting preview Events and abandoning its existing legacy dynamic-scope flow, or failing app-config validation. This blocks unrelated extension deployments.

Start by reproducing the issue with Shopify CLI 4.7.0 using an app config with access_scopes, read_products, and use_legacy_install_flow set to true. Compare shopify app config validate with shopify app deploy --no-release, then verify that Events remains optional for legacy OAuth or that its Product topic accepts the declared scope.