feat(cli+templateengine+deploymanager): resolve follow-ups #4/#5/#6/#8 — CLI ergonomics + structured deploy validation error

Closes the four remaining items in the 2026-06-24 template-inheritance/CLI
follow-up tracker.

#4 — CLI `instance set-bindings` can now set DataSourceReferenceOverride.
  `--bindings` accepts an optional 3rd element per entry:
  [attributeName, dataConnectionId, dataSourceReferenceOverride]. A string
  sets the override; a JSON null or an omitted 3rd element leaves it unset
  (template default). TryParseBindings accepts 2- or 3-element entries and
  rejects a non-string/non-null 3rd element or 4+ elements with a clean
  error. Previously the CLI sent the override as null and silently wiped any
  existing one (only a raw POST /management could set it).

#5 — `template update` is partial, not full-replace (fixed server-side so all
  clients benefit). UpdateTemplateAsync now uses leave-unchanged semantics:
  a null description keeps the stored value (pass "" to clear); a null
  parentTemplateId keeps the existing parent. Parent stays immutable — a
  non-null differing value is still rejected — but omitting --parent-id is
  now a no-op instead of failing every derived-template update.

#6 — compact `template list`/`get` table output + `--detail`. Table output is
  now id/name/description/parent/derived + member counts (#attrs/#alarms/
  #scripts/#comps/#nativeAlarms) via TemplateTableProjection, fed through a
  new optional tableProjector seam on CommandHelpers. `--detail` restores the
  full dump. JSON output is left untouched (always full) so machine consumers
  are unaffected — the projector only runs on the table path.

#8 — structured deploy-time validation error. New ValidationResult.SummarizeErrors()
  (Commons) returns a grouped, capped summary: leading total count, one line
  per ValidationCategory, and a per-module rollup (canonical name up to its
  last dot) with counts + "... and N more module(s)" caps. DeploymentService
  uses it for the "Pre-deployment validation failed" message and logs the full
  per-entry list via LogWarning. Replaces the flat semicolon-joined dump that
  became a wall of text for instances with 50-194 unbound attributes.

Tests: +8 Commons (SummarizeErrors), +8 CLI (4 binding 3-element / 4 table
projection), +2 net TemplateEngine (partial-update). Affected suites green:
Commons 587, CLI 341, TemplateEngine 447, DeploymentManager 101,
ManagementService 230, CentralUI 866; full solution builds 0/0.

Docs: Component-DeploymentManager.md "Validation Error Reporting"; CLI README
(set-bindings 3-element form, template update leave-unchanged, list/get
--detail); UpdateTemplateCommand doc; known-issues tracker #4/#5/#6/#8 resolved
(all 8 items now closed).

src/ZB.MOM.WW.ScadaBridge.CLI/Commands/CommandHelpers.cs

@@ -30,6 +30,13 @@ internal static class CommandHelpers
     /// (<see cref="IsAuthorizationFailure"/>) is preserved on the error path either way,
     /// closing CLI-017's regression.
     /// </param>
+    /// <param name="tableProjector">
+    /// Optional transform applied to the success JSON body <em>only</em> when the resolved
+    /// format is <c>table</c>. Lets a command render a compact table projection (e.g.
+    /// <c>template list</c> dropping per-template attribute dumps, followup #6) while
+    /// leaving JSON output untouched for machine consumers. Ignored when
+    /// <paramref name="onSuccess"/> is supplied.
+    /// </param>
     /// <returns>A task that resolves to the process exit code (0 = success, 1 = error, 2 = authorization failure).</returns>
     internal static async Task<int> ExecuteCommandAsync(
         ParseResult result,
@@ -39,7 +46,8 @@ internal static class CommandHelpers
         Option<string> passwordOption,
         object command,
         TimeSpan? timeout = null,
-        Func<string, int>? onSuccess = null)
+        Func<string, int>? onSuccess = null,
+        Func<string, string>? tableProjector = null)
     {
         var config = CliConfig.Load();
         var format = ResolveFormat(result, formatOption, config);
@@ -98,7 +106,7 @@ internal static class CommandHelpers
             return IsAuthorizationFailure(response) ? 2 : 1;
         }
 
-        return HandleResponse(response, format);
+        return HandleResponse(response, format, tableProjector);
     }
 
     /// <summary>
@@ -158,8 +166,12 @@ internal static class CommandHelpers
     /// </summary>
     /// <param name="response">Response received from the management API.</param>
     /// <param name="format">Output format (<c>json</c> or <c>table</c>).</param>
+    /// <param name="tableProjector">
+    /// Optional transform applied to the JSON body before table rendering only — JSON
+    /// output is never altered. See <see cref="ExecuteCommandAsync"/>.
+    /// </param>
     /// <returns>The process exit code (0 = success, 1 = error, 2 = authorization failure).</returns>
-    internal static int HandleResponse(ManagementResponse response, string format)
+    internal static int HandleResponse(ManagementResponse response, string format, Func<string, string>? tableProjector = null)
     {
         if (response.JsonData != null)
         {
@@ -173,7 +185,11 @@ internal static class CommandHelpers
 
             if (string.Equals(format, "table", StringComparison.OrdinalIgnoreCase))
             {
-                WriteAsTable(response.JsonData);
+                // A table projector compacts the body for terminal display (e.g. dropping
+                // per-template attribute dumps). JSON output stays full/untouched so
+                // machine consumers keep the complete payload.
+                var body = tableProjector != null ? tableProjector(response.JsonData) : response.JsonData;
+                WriteAsTable(body);
             }
             else
             {