Ensure flow (config-as-code converge)

Idempotently converge a repo-defined flow definition onto the platform. Identity is name + account scope. Hash-only probes skip the payload in the steady state (a miss is a normal 200 `definitionRequired` response, not an error); full requests create the flow or append a new version when the canonical content hash differs. Non-executing: never touches the execution pipeline — the deploy-time sibling of the dispatch-coupled `flowMode: "upsert"` (which saves and runs in one request). The response always carries the server-computed canonical hash. Set dryRun to plan without writing (CI drift gate), onConflict: "overwrite" to converge over dashboard/API edits, and release: "publish" to also re-aim the published-version pointer. Optional version.label / version.notes stamp provenance (a git SHA, a release tag) on the appended version row.