Ensure product (config-as-code converge)

Idempotently converge a repo-defined product definition onto the platform. Identity is name + account scope. Hash-only probes skip the payload in the steady state (a miss is a normal 200 `definitionRequired` response, not an error); full requests create the product or update it when the canonical content hash differs. The converge covers the top-level product record only (description, icon, spec) — not nested capabilities/surfaces/tools or canvas layout. The response always carries the server-computed canonical hash. Set dryRun to plan without writing (CI drift gate), and onConflict: "overwrite" to converge over dashboard/API edits. Products have no version snapshots, so there is no publish option.