feat(cli+templateengine+deploymanager): resolve follow-ups #4/#5/#6/#8 — CLI ergonomics + structured deploy validation error

Closes the four remaining items in the 2026-06-24 template-inheritance/CLI
follow-up tracker.

#4 — CLI `instance set-bindings` can now set DataSourceReferenceOverride.
  `--bindings` accepts an optional 3rd element per entry:
  [attributeName, dataConnectionId, dataSourceReferenceOverride]. A string
  sets the override; a JSON null or an omitted 3rd element leaves it unset
  (template default). TryParseBindings accepts 2- or 3-element entries and
  rejects a non-string/non-null 3rd element or 4+ elements with a clean
  error. Previously the CLI sent the override as null and silently wiped any
  existing one (only a raw POST /management could set it).

#5 — `template update` is partial, not full-replace (fixed server-side so all
  clients benefit). UpdateTemplateAsync now uses leave-unchanged semantics:
  a null description keeps the stored value (pass "" to clear); a null
  parentTemplateId keeps the existing parent. Parent stays immutable — a
  non-null differing value is still rejected — but omitting --parent-id is
  now a no-op instead of failing every derived-template update.

#6 — compact `template list`/`get` table output + `--detail`. Table output is
  now id/name/description/parent/derived + member counts (#attrs/#alarms/
  #scripts/#comps/#nativeAlarms) via TemplateTableProjection, fed through a
  new optional tableProjector seam on CommandHelpers. `--detail` restores the
  full dump. JSON output is left untouched (always full) so machine consumers
  are unaffected — the projector only runs on the table path.

#8 — structured deploy-time validation error. New ValidationResult.SummarizeErrors()
  (Commons) returns a grouped, capped summary: leading total count, one line
  per ValidationCategory, and a per-module rollup (canonical name up to its
  last dot) with counts + "... and N more module(s)" caps. DeploymentService
  uses it for the "Pre-deployment validation failed" message and logs the full
  per-entry list via LogWarning. Replaces the flat semicolon-joined dump that
  became a wall of text for instances with 50-194 unbound attributes.

Tests: +8 Commons (SummarizeErrors), +8 CLI (4 binding 3-element / 4 table
projection), +2 net TemplateEngine (partial-update). Affected suites green:
Commons 587, CLI 341, TemplateEngine 447, DeploymentManager 101,
ManagementService 230, CentralUI 866; full solution builds 0/0.

Docs: Component-DeploymentManager.md "Validation Error Reporting"; CLI README
(set-bindings 3-element form, template update leave-unchanged, list/get
--detail); UpdateTemplateCommand doc; known-issues tracker #4/#5/#6/#8 resolved
(all 8 items now closed).

src/ZB.MOM.WW.ScadaBridge.TemplateEngine/TemplateService.cs

@@ -90,12 +90,17 @@ public class TemplateService
     }
 
     /// <summary>
-    /// Updates a template's name and description. Parent template is immutable after creation.
+    /// Updates a template's name and (optionally) description. Optional fields use
+    /// leave-unchanged semantics so an omitted field is not silently wiped (followup #5):
+    /// a <c>null</c> <paramref name="description"/> leaves the stored description as-is —
+    /// pass an empty string to explicitly clear it. Parent template is immutable after
+    /// creation; a <c>null</c> <paramref name="parentTemplateId"/> leaves it unchanged,
+    /// and a non-null value that differs from the current parent is rejected.
     /// </summary>
     /// <param name="templateId">ID of the template to update.</param>
-    /// <param name="name">New name for the template.</param>
-    /// <param name="description">New description.</param>
-    /// <param name="parentTemplateId">Must match the existing parent (cannot be changed).</param>
+    /// <param name="name">New name for the template (required, non-empty).</param>
+    /// <param name="description">New description, or <c>null</c> to leave unchanged. Empty string clears it.</param>
+    /// <param name="parentTemplateId"><c>null</c> to leave unchanged; a non-null value must match the existing parent (cannot be changed).</param>
     /// <param name="user">Username of the user updating the template.</param>
     /// <param name="cancellationToken">Cancellation token.</param>
     /// <returns>Result containing the updated template or failure message.</returns>
@@ -115,15 +120,20 @@ public class TemplateService
             return Result<Template>.Failure($"Template with ID {templateId} not found.");
 
         // ParentTemplateId is immutable after creation — set once at create time.
-        // Reject any attempt to change it (null→value, value→null, or value→other).
-        if (parentTemplateId != template.ParentTemplateId)
+        // A null parentTemplateId means "leave unchanged" (an omitted CLI/API field),
+        // so only a non-null value that differs from the current parent is rejected.
+        // Immutability still holds: there is no path that mutates ParentTemplateId here.
+        if (parentTemplateId != null && parentTemplateId != template.ParentTemplateId)
         {
             return Result<Template>.Failure(
                 "Parent template cannot be changed after creation.");
         }
 
         template.Name = name;
-        template.Description = description;
+        // Leave-unchanged semantics: only overwrite the description when a value is
+        // supplied. null = not provided (keep existing); "" = explicit clear.
+        if (description != null)
+            template.Description = description;
 
         // Check for naming collisions after the change
         var collisionResult = await ValidateCollisionsAsync(template, cancellationToken);