fix: address code review issues in flow-to-library sync

- Fix sync trigger: only fire on publish transition, not every PUT
- Add TestSyncOnPublish integration tests (2 tests, 16 total passing)
- Add group_label to frontend StepContent interface
- Guard Library Visibility select to procedure_step nodes only
- Block API edits to flow-synced steps (400 read-only guard)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/components/procedural-editor/StepEditor.tsx

@@ -255,8 +255,8 @@ export function StepEditor({ step, stepNumber, onUpdate, onCollapse, availableVa
               </div>
             </div>
 
-            {/* Library Visibility */}
-            <div>
+            {/* Library Visibility — procedure_step nodes only */}
+            {step.type === 'procedure_step' && <div>
               <label htmlFor="library-visibility" className="mb-1.5 block text-xs font-medium text-muted-foreground">
                 Library Visibility
               </label>
@@ -275,7 +275,7 @@ export function StepEditor({ step, stepNumber, onUpdate, onCollapse, availableVa
               <p className="mt-1 text-[10px] text-muted-foreground">
                 Controls visibility in the step library. Defaults to the flow's own visibility setting.
               </p>
-            </div>
+            </div>}
           </div>
         )}
       </div>

frontend/src/types/step.ts

@@ -10,6 +10,7 @@ export interface StepContent {
   instructions: string
   help_text?: string
   commands?: StepCommand[]
+  group_label?: string
 }
 
 export interface Step {