Ensure surface (config-as-code converge)

Idempotently converge a repo-defined surface definition onto a product. Identity is name + product. Hash-only probes skip the payload in the steady state (a miss is a normal 200 definitionRequired response, not an error); full requests create the surface or update it when the canonical content hash differs. The response always carries the server-computed canonical hash. Set dryRun to plan without writing (CI drift gate), and onConflict: “overwrite” to converge over dashboard/API edits. Surfaces have no version snapshots, so there is no publish option. inbound/outbound are excluded from the content hash, so a request carrying them must send the full definition; changes to them are reported in changedKeys (as inbound.<key> / outbound.<key>) and converge as “updated”.