Separate editing from running with a draft/publish split

Edits autosave to flow.draft.json and nodes.draft/ instead of the files the
engine reads, so the pipeline keeps running the published version until
someone publishes. Every save carries the version it was based on: a second
client editing the same flow is refused with 409 and offered the choice
between their version and its own, rather than silently overwriting.

Draft saves no longer rebuild the pipeline; validation and node status for a
draft come from a throwaway build that never touches live state.

Also fixes a latent bug where an empty state backend is falsy, so Pipeline
quietly built itself a second, private state and left message history empty.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ROADMAP.md

@@ -54,6 +54,10 @@ external interfaces. See `docs/architecture/structure.canvas` → *Backend – M
 - [x] Dependency-loop detection and graph validation surfaced as API errors
 - [ ] MQTT broker / InfluxDB compose services for local development
 - [x] Git-based versioning of the flow store (one commit per saved change)
+- [x] Draft/publish split: edits autosave to `flow.draft.json` / `nodes.draft/`,
+      the engine runs only the published files, and publishing promotes the
+      draft. Saves carry the version they were based on, so a second client
+      editing the same flow is refused rather than overwritten
 - [ ] Import/export of a flow as human-readable code plus a JSON structure
 - [ ] Per-input/-output discretization interval setting
 - [ ] Alert / notification handler
@@ -88,6 +92,8 @@ React + Vite, primarily desktop but usable on mobile. See `docs/architecture/str
 - [x] Embedded code editor (Monaco) for node source
 - [x] Live values on the edges, with the last payload and its time on click
 - [x] Validation shown on the node it belongs to, and summarised in the dock
+- [x] Publish control and draft markers in the flow bar, discard in the flow
+      panel, and a conflict dialog when another client got there first
 - [ ] Device assignment per node, selectable from compatible devices
 - [ ] Test-node affordance on the canvas
 - [ ] User management screens