Update Organization Guardrail

Partial update. Only the fields the caller sets are applied.

credential and url have three states rather than two, which is what a write-only field and its nullable partner need: omit to leave the stored value alone, send "" to clear it, send a value to replace it. An explicit null also leaves them alone, matching WorkspaceMcpServerUpdate: a client that serializes its whole form back, with an empty credential box it never filled in, must not destroy a credential it was never shown.

workspace_ids replaces the scope whole when sent; [] clears it.

definition_id diverges: an explicit null clears it. The rule above protects a field the client was never shown, and this one is returned on every read, so a form sending null is sending back a field it was given rather than an empty box it never filled in. Omitting it still leaves the link alone.

The API-facing shape. Never carries the credential, nor a credential-shaped parameter.

validate_kwargs is the second place a credential lives on this row, and the one with no column of its own: a guardrail class can take a vendor key as a parameter, so the form offers a box for it and whatever is typed there is stored as plain JSON. It is masked the way org_provider_keys.client_args is, by the name of the entry rather than by what the guardrail catalog says about it, so the mask still applies when the guardrails service is down and no catalog can be read.