Harden the shared library converter

Split out of #18662: the converter/manifest hardening without the
download parallelization, which stays there.

The PIO extra-script shim moves from espidf/ to platformio/ and gains
type checks for every manifest field, capture of the Append variants and
CPPPATH, warn-once diagnostics for unmodelled env reads, and uniform
shlex quoting so captured values survive the lex_build_flags round-trip.
The dependency walk normalizes every spelling PIO accepts, splits the
routine cross-platform skip (IncompatiblePlatform) from real manifest
problems, validates manifest shape once, and the shared flag lexer
warns and drops trailing or empty glued arguments.

script/determine-jobs.py

@@ -537,6 +537,7 @@ ESP_IDF_INFRA_TRIGGER_FILES = frozenset(
         "esphome/build_gen/espidf.py",
         "esphome/framework_helpers.py",
         "esphome/platformio/library.py",
+        "esphome/platformio/extra_script.py",
     }
 )