[eas-cli] Support protected update channels

[sjkim-expo]

Why

Protected EAS Update channels are already supported by the API and dashboard, but eas-cli did not show their protection state or let an admin change it.

This addresses ENG-25975.

How

I added eas channel:protect and eas channel:unprotect, following the structure from other CLI commands. Unprotecting asks for confirmation since it removes a release restriction. Non-interactive use requires the channel name to be passed explicitly.

The CLI calls the existing mutations and surfaces the resulting channel. Channel list and view output now include the protection state in both human-readable output and JSON.

Test Plan

• Added tests for the queries, mutations, rendering, confirmation flow, JSON output, and non-interactive validation.
• Ran the eas-cli test suite, workspace build, typecheck, lint, and formatting checks.
• Tested the local CLI against a disposable channel on @sjkim95/eas-operator:

Channel:
Name        eng-25975-dogfood-20260831
Status      Active
Protection  Unprotected

[linear-code]

ENG-25975

[github-actions]

Subscribed to pull request

File Patterns	Mentions
packages/eas-cli/**	@douglowder
packages/eas-cli/src/update/**	@wschurman, @quinlanj
packages/eas-cli/src/channel/**	@wschurman, @quinlanj
packages/eas-cli/src/commands/channel/**	@wschurman, @quinlanj

Generated by CodeMention

Warning: The preamble and epilogue options in commentConfiguration are deprecated. Use template instead.

[github-actions]

🤖 AI code review

Decision: Ready for human review

Overall PR risk: Medium. The change adds two new commands, channel:protect and channel:unprotect, and it modifies shared code paths. It adds isProtected to the channel fragment and to queries used by channel:view, channel:list, channel:create, channel:pause, channel:resume, and eas update. The reviewer confirmed the GraphQL schema already supports isProtected and both new mutations, so the added field should resolve correctly on the server. The human-readable channel header gains one line, which could break scripts that parse text output, but the --json output change is additive only. No findings from any reviewer reached warning or critical severity, and no secret or credential handling is affected, so the blast radius stays limited to channel read and write paths with direct rollback.

No findings.

---

This review is advisory — it never blocks a merge and never auto-approves.

[sjkim-expo]

@tchayen @gwdp Checks on graphQL schema are failing because the live API replaced top-level deviceIdentifier with specific android and ios inputs. Waiting on a merge here from @szdziedzic draft: #4317

[codecov]

Codecov Report

❌ Patch coverage is 95.34884% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 65.47%. Comparing base (4b1e5a7) to head (26a2f17).

Files with missing lines	Patch %	Lines
packages/eas-cli/src/commands/channel/unprotect.ts	91.67%	3 Missing ⚠️
packages/eas-cli/src/commands/channel/protect.ts	96.67%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4319      +/-   ##
==========================================
+ Coverage   65.38%   65.47%   +0.09%     
==========================================
  Files        1058     1061       +3     
  Lines       49090    49176      +86     
  Branches    10353    10370      +17     
==========================================
+ Hits        32095    32194      +99     
+ Misses      16879    16866      -13     
  Partials      116      116              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

✅ Thank you for adding the changelog entry!