fix(flows): mark updateFlow body path optional in the openapi contract

Adds an `EditFlow` schema (path optional) for the update route so the public
contract matches the server; createFlow keeps `OpenFlowWPath` (path required).
Also trims two test comments to record constraints rather than history.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/windmill-api/openapi.yaml

@@ -10775,7 +10775,7 @@ paths:
           application/json:
             schema:
               allOf:
-                - $ref: "#/components/schemas/OpenFlowWPath"
+                - $ref: "#/components/schemas/EditFlow"
                 - type: object
                   properties:
                     deployment_message:
@@ -29097,6 +29097,37 @@ components:
                 type: string
           required:
             - path
+    # Like OpenFlowWPath but `path` is optional: on update the flow is identified by
+    # the URL, so the body path is only needed to rename it. Kept as a separate schema
+    # (rather than making OpenFlowWPath.path optional) so createFlow still requires path.
+    EditFlow:
+      allOf:
+        - $ref: "../../openflow.openapi.yaml#/components/schemas/OpenFlow"
+        - type: object
+          properties:
+            path:
+              type: string
+            tag:
+              type: string
+            ws_error_handler_muted:
+              type: boolean
+            priority:
+              type: integer
+            dedicated_worker:
+              type: boolean
+            timeout:
+              type: number
+            visible_to_runner_only:
+              type: boolean
+            on_behalf_of_email:
+              type: string
+            preserve_on_behalf_of:
+              type: boolean
+              description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original on_behalf_of_email value instead of overwriting it."
+            labels:
+              type: array
+              items:
+                type: string
 
     FlowPreview:
       type: object

backend/windmill-api/src/mcp/utils.rs

@@ -698,7 +698,7 @@ mod tests {
     fn build_request_body_maps_body_path_alias_for_rename() {
         // The mangled body field carries the *new* path when renaming; it must reach the
         // API under its original name `path`. (An omitted `path__body` is intentionally
-        // absent from the body — the server defaults it from the URL path parameter.)
+        // absent from the body; the server defaults it from the URL path parameter.)
         let (path_schema, body_schema, body_renames) = update_flow_schemas();
         let args: serde_json::Map<String, Value> = json!({
             "path": "f/team/my_flow",

backend/windmill-types/src/flows.rs

@@ -1286,13 +1286,11 @@ mod tests {
 
     #[test]
     fn edit_flow_defaults_path_from_url_and_renames_when_given() {
-        // Omitted body path: update in place at the URL path (GIT-925 — a body
-        // without `path` used to fail deserialization on the required NewFlow.path).
+        // An omitted body path resolves to the URL path; an explicit body path renames.
         let ef: EditFlow =
             serde_json::from_value(json!({ "summary": "s", "value": { "modules": [] } })).unwrap();
         assert_eq!(ef.into_new_flow("f/team/my_flow").path, "f/team/my_flow");
 
-        // Explicit body path: rename to it.
         let ef: EditFlow = serde_json::from_value(
             json!({ "path": "f/team/renamed", "summary": "s", "value": { "modules": [] } }),
         )