fix(google-vault): fail loudly instead of silently clearing hold scope on update

Cursor Bugbot: PUT holds/{id} replaces the full resource — a name/query-only
update with no accountEmails/orgUnitId would silently drop the hold's
custodian coverage. Now throws a clear error directing callers to resend the
scope or use add_held_accounts/remove_held_accounts for incremental changes.

Author: waleedlatif1

apps/sim/tools/google_vault/update_matters_holds.ts

@@ -117,6 +117,12 @@ export const updateMattersHoldsTool: ToolConfig<GoogleVaultUpdateMattersHoldsPar
         body.accounts = emails.map((email: string) => ({ email }))
       } else if (params.orgUnitId) {
         body.orgUnit = { orgUnitId: params.orgUnitId }
+      } else {
+        throw new Error(
+          'Updating a hold replaces its full scope: re-provide the current Account Emails or Org Unit ID ' +
+            '(they are not preserved automatically). To add or remove individual custodians without ' +
+            'resending the full scope, use Add Held Accounts / Remove Held Accounts instead.'
+        )
       }
 
       if (params.corpus === 'MAIL' || params.corpus === 'GROUPS') {