Separate editing from running with a draft/publish split

Edits autosave to flow.draft.json and nodes.draft/ instead of the files the
engine reads, so the pipeline keeps running the published version until
someone publishes. Every save carries the version it was based on: a second
client editing the same flow is refused with 409 and offered the choice
between their version and its own, rather than silently overwriting.

Draft saves no longer rebuild the pipeline; validation and node status for a
draft come from a throwaway build that never touches live state.

Also fixes a latent bug where an empty state backend is falsy, so Pipeline
quietly built itself a second, private state and left message history empty.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

frontend/src/components/Flow/useFlowSocket.ts

@@ -1,7 +1,9 @@
+import { useQueryClient } from "@tanstack/react-query"
 import { useEffect, useRef } from "react"
 
 import { OpenAPI } from "@/client"
 import { liveStore } from "./liveStore"
+import { flowKeys } from "./queries"
 
 const RECONNECT_MIN = 1000
 const RECONNECT_MAX = 30000
@@ -42,6 +44,7 @@ export function useFlowSocket(onAuthFailure?: () => void): void {
   const retry = useRef(RECONNECT_MIN)
   const timer = useRef<ReturnType<typeof setTimeout> | null>(null)
   const closed = useRef(false)
+  const queryClient = useQueryClient()
 
   useEffect(() => {
     closed.current = false
@@ -87,6 +90,9 @@ export function useFlowSocket(onAuthFailure?: () => void): void {
             break
           case "pipeline_rebuilt":
             liveStore.setStatuses(message.nodes)
+            // Someone published, here or in another tab: the draft markers on
+            // the flow chips are stale until the list is fetched again.
+            queryClient.invalidateQueries({ queryKey: flowKeys.all })
             break
         }
       }
@@ -111,5 +117,5 @@ export function useFlowSocket(onAuthFailure?: () => void): void {
       socket.current?.close()
       liveStore.setConnected(false)
     }
-  }, [onAuthFailure])
+  }, [onAuthFailure, queryClient])
 }