Takes the workflow live: publishes the current draft and turns the workflow
on so it accepts triggers.

When a draft exists (any workflow edited through createWorkflowStep /
updateWorkflowStep / deleteWorkflowStep has one), the draft is copied to
a new version, that version becomes current, and the draft is consumed —
so draft edits go live rather than being left behind. When no draft exists,
the existing current version is simply turned on.

Every step's configuration is validated here, not while editing. Incomplete
steps return 422 with one error per problem, each naming the offending
step_id and field. For app action steps this includes empty or missing
required static input fields from the app definition (e.g. Slack
channel) — use the returned step_id (UUID) to call updateWorkflowStep
and fix the issue. Any alias present in the error is only useful for
identifying/labeling which step failed for humans, not as the request
identifier. A workflow with neither a draft nor a current version
returns 422.

OAuth callers require the workflows:update scope.