Update a draft envelope's graph

Combined draft update: any subset of participants, fields, and policy, applied in one transaction (allowed in draft and review status). Replacing participants cascade-deletes fields, so participants requires fields in the same call. Fields are full-replace: echo each field's autoSource and proposedAutoSource as read, or the binding is cleared / the detection proposal dismissed. expectedVersion is checked strictly when supplied; omitted, the current version is used. Supports the Idempotency-Key header: a replayed completed key returns the envelope's current graph with the original status code and Idempotency-Replayed: true (never re-executing); an in-flight duplicate is rejected 409; reusing a key with a different request is rejected 422.