Update or publish an automation

One endpoint, two mutually-exclusive modes:

• Update — supply one or more of name, description, nodes, connections, triggerEventId. Graph updates persist a new automationVersionId on the same automationId. Add dryRun: true to validate a graph update without persisting.
• Lifecycle — supply published: true to promote the stored latest version live (validates the graph first → 409 PUBLISH_VALIDATION_FAILED on blockers; optionally pin automationVersionId to publish a specific version), or published: false to unpublish.

Graph updates use the same strict typed filter/split condition contract as create: explicit type, canonical snake_case operator, no value for unary operators, and type-correct values everywhere else.

The two modes cannot be combined: publishing promotes the stored graph, so update first, then PATCH { "published": true }. Returns the bare automation row.