Partially updates one step on the workflow draft (input mapping, credential,
action config via data, plus optional name / metadata / samples).

Deep-merges data and metadata into the existing step. If no draft exists
yet, creates one from the published version — step IDs may remap; the
response returns the updated draft step.

Keep template identity fields such as subtype, app_id, app_version_id,
and credential_id at the top level of data; put operation fields inside
data.operation.perform. Never invent a mapping path: test the upstream step
and copy its documented output path. Action results commonly use
${alias.output.data.field}; trigger values may use ${alias.input.field}.
Never use {{steps.alias.field}}.

Validation

• Ensures the workflow and step exist on the editable draft for the
  authenticated organization.
• When data / metadata change, re-validates graph placement for the
  draft.
• Uses optimistic concurrency against the draft (or published version when
  creating a draft). Concurrent races return 409 stale_draft.
• Full step config completeness is validated on publish, not on patch —
  incomplete data is allowed while the agent is still configuring.

Typical agent loop after createWorkflowStep: patch inputs →
testWorkflowStep → publishWorkflow.

OAuth callers require the workflows:update scope (and matching workspace
permission). API key callers are authorized by organization membership.