Creates one step on the workflow draft without requiring a full-graph sync.
Prefer this over any full draft replace when building or editing workflows
as an agent.

Agent workflow

1. Call listWorkflowStepTypes (optionally with workflow_id +
   parent_step_id) to discover valid options and copy a create-ready
   step_template.
2. Call this endpoint with the template fields (name, type, data,
   plus previous_step_id / parent_step_id / child_role as needed).
3. Call updateWorkflowStep to fill input mappings / credentials.
4. Call testWorkflowStep to verify behavior.
5. Call publishWorkflow when the draft is ready.

Validation

• Ensures the workflow exists and belongs to the authenticated organization.
• Ensures previous_step_id / parent_step_id (when provided) reference
  steps on the editable draft (or published current version when no draft
  exists yet).
• Enforces graph placement (trigger only at root, allowed next steps,
  nested child roles under loop / wait_for).
• Uses optimistic concurrency against the draft (or published version when
  creating a draft). Concurrent races return 409 stale_draft.
• Full step config completeness (required fields per action/app) is
  validated on publish, not on create — incomplete data is allowed
  while the agent is still configuring the step.

If no draft exists yet, creates one from the published version (step IDs
may remap for links that pointed at published steps).

OAuth callers require the workflows:update scope (and matching workspace
permission). API key callers are authorized by organization membership.