Update Staged Agent Settings

The Versioned-surface subset of what PATCH /agents/{id} used to accept in one schema - system_prompt, first_message, llm_provider, conversation_storage_enabled, evaluation settings, widget settings, and custom_variables. Every field independently optional, same omitted-means-don't-touch contract as every other patch schema in this file. voice is deliberately not here - see PATCH /agents/{id}/stage/voice's own schema instead.

conversation_storage_enabled is the owner-facing off switch the conversation-persistence design spec's "on by default" scope decision rests on - it is the mitigation that makes storing full transcripts by default acceptable, so it has to be writable from this route.

evaluation_enabled, extraction_field_defs, and evaluation_criteria_defs are independently optional - each may be sent alone or omitted. This works because Agent.extraction_field_defs and Agent.evaluation_criteria_defs are non-nullable JSONB columns with an empty-list default: the database never distinguishes "unset" from "empty", so an omitted field here unambiguously means "don't touch it" and an explicit [] unambiguously means "clear it" - there is no third state to disambiguate, so no model_validator is needed to detect a partial submission.

widget_enabled, widget_public, widget_accent_color, widget_orb_color_1, and widget_orb_color_2 follow the same independently-optional pattern as the evaluation-settings group above - none is ambiguous between "omitted" and "cleared", since all three color columns are genuinely nullable and the two booleans default False rather than needing a distinct "unset" state. widget_allowed_domains follows the list-field pattern instead (like extraction_field_defs/evaluation_criteria_defs above): the column is a non-nullable JSONB with an empty-list default, so an omitted field here unambiguously means "don't touch it" and an explicit [] unambiguously means "clear/unrestrict it" - no validator needed. widget_style_overrides follows the same list-field pattern as widget_allowed_domains (non-nullable JSONB dict, empty-dict default - omitted means "don't touch it", {} means "reset to the widget's own built-in defaults"), with an added key-allowlist validator since this dict's keys are a styling convention shared with two renderers (see WIDGET_STYLE_OVERRIDE_KEYS above), not free-form. widget_embed_key is deliberately absent from this schema: it is never owner-supplied, only generated/rotated via its own dedicated action route (POST /agents/{agent_id}/stage/widget/regenerate-key) - an owner-chosen value would be guessable, defeating its purpose as an unguessable public identifier.

custom_variables follows the same list-field pattern as widget_allowed_domains (non-nullable JSONB dict, empty-dict default - omitted means "don't touch it", {} means "clear everything"), with an added key-grammar validator: names must be plain identifiers (letters, digits, underscore only), since a "." or "[" would be ambiguous with the {{config.name}} path syntax the value is interpolated into at workflow run time.

llm_provider binds (or rebinds) the agent's LLM provider, mirroring deployment_id's own "omitted means don't touch" semantics - there is no way to explicitly clear it back to unbound via this PATCH, matching deployment_id (an agent only ever moves from unbound to bound, or from one bound value to another, never back to unbound).

llm_credential_id picks one of the org's credentials for the bound provider explicitly; null (the default) lets resolution fall through to the org's default and then the platform's metered key. Pass an explicit null to clear an earlier choice.

See docs/superpowers/specs/2026-09-05-agent-config-versioning-design.md's API surface section: this is the "stage" half of what PATCH /agents/{id} used to do in one call, the other half (deployment_id, a2a_open, a2a_discoverable) staying on that original endpoint since neither is part of the Versioned surface.