refactor(cli): cover shared/functions helpers with effect lint (CLI-2592)

[7ttp]

TL;DR

brings the functions download, delete, config and shared helpers under the effect lint

whats introduced?

• the download, delete, functions-api, functions.shared and functions-config modules join the allow list file by file, so the rest of shared/functions waits for the later PRs in this stack
• download runs on the FileSystem and Path services instead of node:fs and node:path, with a posix Path for container and API paths
• the temp file still opens with wx, renames into place and is removed when the rename fails
• host failures keep their native error text, and the four plain Error failures on the eszip path become an untagged FunctionEszipDownloadError with the same telemetry
• the functions list and metadata responses decode through Schema, so a malformed response now reads Expected a valid JSON string instead of the parser message
• downloadFunctions and deleteFunction become Effect.fn with the same span names
• integration tests cover an empty file, a malformed list or metadata response, a mistyped list, a failed rename with temp cleanup, a failed temp dir and the native host errors on the eszip path

ref

• related: CLI-2592

[github-actions]

🤖 AI Review

Verified all four findings and merged the duplicate cleanup reports into three entries. Two findings are confirmed, including a temp-file leak that predates this PR. The claimed cleanup regression is refuted: an in-memory comparison using the trusted bundled Effect implementation showed that both versions propagate cleanup rejection as a defect.

Findings

Severity	Location	Category	Sources	Claim
🟡 MINOR	apps/cli/src/shared/functions/download.ts:666	error-handling	claude	A writeAll failure leaves the already-created .supabase-download-.tmp file in the destination directory.
🟡 MINOR	apps/cli/src/shared/functions/download.errors.ts:48	telemetry	codex	FunctionEszipDownloadError lacks the required actionability getter and stable fingerprint declaration for an app-owned untagged error class.

Refuted findings (kept for transparency, not posted as review comments)

• apps/cli/src/shared/functions/download.ts:686 (error-handling): The PR introduces a regression where failed rename cleanup becomes a defect, replacing the typed download error and bypassing partial-download reporting; previously cleanup failure was ignored.
  Refuted: The current defect behavior exists, but it is not introduced by this PR. Effect.promise turns promise rejection into a defect, and Effect.ignore suppresses typed failures only. Executing both cleanup compositions with the trusted bundled Effect implementation produced the same Die reason carrying the cleanup error. The old implementation therefore also lost the rename error and bypassed typed partial-download reporting.

Stats

Claude findings: 2 · Codex findings: 2 · Confirmed: 2 · Refuted: 1 · Uncertain: 0

---

Models: claude-opus-5-5 + gpt-6.1-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.