Workflow: maintain a template safely

Read the template and ETag, update its draft, then previewTemplateApplication against an explicit item scope. Show additions, removals, conflicts, and affected versions to the user. Only after approval call applyTemplateToItems with confirmation token, identical scope, ETag, and idempotency key. Reread selected and untouched items.

Expected state: selected items receive only approved changes; untouched existing items remain byte-for-byte equivalent in workflow meaning.