Workflow: remove demo/replay UI; nodes must be real ephemeral Bots #1443

Written-by: Chief
Owner: Dev

Ask (owner 2026-10-27 Asia/Shanghai)

1. 删掉「开始演示」/ Replay demo / Run demo 等按钮 — 只允许真实运行。
2. Workflow 里的 Bot 必须是真实 Bot（临时、带工具/权限、按节点配置 spawn，跑完销毁、不上侧栏）— 不是无权限壳或脚本假进度。

Context

Prod tip 405e408f (#1412) already Bot-gates live runs. UI still exposes demo/replay (Replay demo / workflow/demo-step in plugins/workflow/client.js). Strip those entry points. Verify each node spawn uses real Bot config (tools/permissions), not a permissionless placeholder.

Done when

• No user control starts demo/replay; client does not call workflow/demo-step for product flows.
• Assign/run still starts live graph runs with ephemeral real Bots per node.
• docs/subsystems/workflow.md + changelog; tests green.
• Separate PR from Settings → Workflow graphs: canvas-first with inspector #1440; base main.