Harden the shared library converter

Split out of #18662: the converter/manifest hardening without the
download parallelization, which stays there.

The PIO extra-script shim moves from espidf/ to platformio/ and gains
type checks for every manifest field, capture of the Append variants and
CPPPATH, warn-once diagnostics for unmodelled env reads, and uniform
shlex quoting so captured values survive the lex_build_flags round-trip.
The dependency walk normalizes every spelling PIO accepts, splits the
routine cross-platform skip (IncompatiblePlatform) from real manifest
problems, validates manifest shape once, and the shared flag lexer
warns and drops trailing or empty glued arguments.

tests/script/test_determine_jobs.py

@@ -1124,6 +1124,7 @@ def test_should_run_esp32_platformio_with_branch() -> None:
         (["esphome/build_helpers/idedata.py"], True),
         (["esphome/platformio/library.py"], True),
         (["esphome/framework_helpers.py"], True),
+        (["esphome/platformio/extra_script.py"], True),
         # PlatformIO build gen, its toolchain, and the esp32 component are
         # NOT IDF-infra triggers
         (["esphome/platformio/toolchain.py"], False),