Replace the whole variable set

Whole-set replacement, not a patch. Whatever you send IS the complete set: any variable you omit is deleted — plain ones removed from the definition, sensitive ones removed from the encrypted store. Read with GET first, edit the list, send it all back.

How to keep a secret you were never given: a client cannot echo back a sensitive value, because GET never returns one. Send that entry with isSecret: true and keep: true and no value — the stored value is retained. A sensitive entry WITHOUT keep is being given a new value, and that value is required.

Rules the server enforces (each is a 422, and the whole write is refused — nothing is partially applied):

• Names must be valid expression paths: no dots (the resolver splits on .), and usable from JavaScript.
• No duplicate names — two rows with the same name is refused rather than silently collapsing onto the last.
• A sensitive value must be at least 8 characters. A shorter one is REFUSED, not stored unprotected: run data is masked by matching the VALUE, and a very short value would blank out unrelated text everywhere it appeared.
• A sensitive value has a maximum byte length, and there is a cap on how many sensitive variables one workflow may hold.
• isSecret: true with no encryption key configured on the server (secretsAvailable: false) is refused.

On success the response is the same body GET would return — so the sensitive values you just wrote are NOT echoed back.

Ordering note: the plain half is written to the definition first and the sensitive half second. A failure on the sensitive half returns 500 with the definition change already applied.