fix(blueprints): preserve bindings on code-only updates

[ai-yang]

Fixes #147

Summary

Make Overseer.updateBlueprint() refresh binding metadata only when callers explicitly pass updateBindings: true.

The API already treats updateCode and updateBindings as independent flags, and the Workshop's Update code action sends only { updateCode: true }. Previously, that call still collected and replaced binding metadata, which could silently change the published blueprint contract or reject on an unrelated invalid annotation.

The production change is intentionally limited to guarding the existing binding collection. Code-only, bindings-only, and combined updates otherwise retain their existing propagation behavior.

Regression coverage

The new tests verify that:

• a code-only update never calls collectBindingMetadata(), preserves existing bindings, and still succeeds when collection would throw;
• a bindings-only update refreshes bindings without taking a code snapshot; and
• a combined update refreshes both code and bindings in one propagation pass.

Test plan

• pnpm --filter @gadgets/workshop-backend exec vitest run __tests__/blueprint-update.test.ts — 1 test file / 3 tests passed
• pnpm --filter @gadgets/workshop-backend test — 26 unit-test files / 282 tests passed; 4 environment-dependent integration tests skipped by the existing configuration
• pnpm --filter @gadgets/workshop-backend types:check
• pnpm exec oxlint packages/workshop-backend/src/overseer.ts packages/workshop-backend/__tests__/blueprint-update.test.ts — exit 0; pre-existing warnings in overseer.ts are unchanged
• git diff --check

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[ai-yang]

I have read the CLA Document and I hereby sign the CLA

[ai-yang]

Hi maintainers — this PR was opened before the new contribution-policy workflow was added.

The production change is 8 changed lines; the deterministic regression test accounts for the remaining 151 lines. I rechecked current main, and code-only blueprint updates still refresh binding metadata unconditionally.

Would you prefer to keep the regression test under a policy/override label, or should I revise this into a production-only patch below the 30-line automatic limit? Once you confirm the preferred scope, I can rebase onto current main, update the PR description to the current template, and rerun validation.

If the current scope is acceptable, could you also approve the pending CI and Bonk PR Review workflows when convenient?

Thank you.