Summary

Implements showcase-workspace E4 — restore/replay (closes #393, umbrella #389). The E1 showcase_workspace rows become listable/loadable over two new GET endpoints, and the Showcase page gains workspace controls plus a server-backed panel with Load (re-attach, read-only) and Replay (verbatim re-run through the existing WS path with preservation="keep").

All additive — no migration, no schema change, no pipeline.py / models.py changes.

Backend

• GET /demo/workspaces — paginated list, newest first; 200 + empty page on an empty table (mirrors GET /scenarios).
• GET /demo/workspaces/{workspace_id} — full row incl. created_objects; 404 application/problem+json when missing.
• New WorkspaceListItem / WorkspaceDetailResponse / WorkspaceListResponse response models (plain BaseModel + from_attributes — strict mode stays request-body-only) and a count_workspaces helper next to the E1 read helpers these routes consume.

Frontend

• Showcase controls: Seed input (previously hardcoded 42), Save as workspace checkbox + name input with client-side pattern validation that disables Run on violation.
• WorkspacePanel — lists saved workspaces (scenario, seed, status, winner, destructive-reset badge) with Load/Replay; refreshes via query invalidation when a kept run completes.
• WorkspaceArtifactsPanel — deep-link card grid rebuilt from created_objects + grain columns (winning/V2 runs, scenario plans, batch, alias, grain-scoped forecast/backtest, agent session).
• Load repopulates scenario/seed/reset/skip_seed/keep/name (calling setScenario before start — picker-desync gotcha); Replay re-submits the recorded config verbatim and always creates a NEW workspace row.
• RunHistoryStrip now records ephemeral runs only — a summary carrying a workspaceId is not appended (server is source of truth for kept runs).

Tests

• Route unit tests (workspace helpers monkeypatched) + integration tests against real Postgres (newest-first list, pagination, JSONB round-trip, 404).
• Replay regression (test_demo_replay_same_config_twice): the identical keep-config runs twice back-to-back — both green, no 409/500 (guards the fix(registry): _find_duplicate raises MultipleResultsFound under detect policy #146 _find_duplicate and fix(showcase): make safer promote artifact URI compatible with scenario replay #324 safer-promote fixes), distinct workspace ids, both rows listed as completed.
• Frontend vitest for the reducer (workspaceId capture + legacy null), both new panels, and the ephemeral-only strip append. 349 tests green.

Docs

• docs/_base/API_CONTRACTS.md — two endpoint rows + an E4 note on the WS section (additive; no overlap with E3's edit).

Validation

• ruff check + ruff format --check + mypy --strict + pyright --strict + pytest -m "not integration" (1975) ✅
• Full integration suite on a fresh DB: 303 passed ✅ (incl. the replay regression e2e)
• Frontend pnpm lint && pnpm test --run (349) ✅
• Browser dogfood on a seeded stack: save → list → load (controls + deep links restore, winning-run link resolves) → replay (green, second row) → ephemeral run feeds localStorage only ✅

Notes / deferred (per PRP)

• No replayed_from provenance column (needs a migration — possible follow-up).
• No DELETE endpoint (out of issue scope).