Thanks a lot for your answer and your hints, very much appreciated.
I tried setting up the Shopify Customer Privacy API tag for GTM web to properly sync Cookiebot consent with Shopify’s Customer Privacy API, and moved Cookiebot back to theme.liquid. Because that sounded quite promising. The setup of the tag looks as following:
When I test window.Shopify.customerPrivacy.currentVisitorConsent() in the browser console on the checkout page, I get:
Uncaught TypeError: Cannot read properties of undefined
(reading 'currentVisitorConsent') at <anonymous>:1:32
So window.Shopify.customerPrivacy is completely undefined in the checkout context.
On top of that, document.cookie throws a SecurityError in the Custom Pixel sandbox:
Uncaught SecurityError: Failed to read the 'cookie' property
from 'Document': The document is sandboxed and lacks the
'allow-same-origin' flag.
So both approaches to read the consent state inside the Custom Pixel are blocked. The only setup that actually worked (purchase events with gcs=G111 reaching the sGTM) was Cookiebot via GTM with the cookie-consent.liquid snippet disabled.
Any more ideas what to change or try?