[SandObserver]

Summary

• Add .github/workflows/demo.yml: start a released image with DEMO_MODE=true, tour the dashboard and admin in Chromium, record every API answer every 5 s for 10 minutes, and build a static copy of the image's web root.
• Inject scripts/demo/replay.js into every page. It answers /api/ requests from the recording by current time, loops it, shifts recorded timestamps, and falls back to the image's own answers for writes and unrecorded queries.
• Store the recording as content-hashed 5-minute chunks served immutable, and generate _headers and _redirects from the headers the image sends for every file and route.
• Upload to Cloudflare Workers static assets as a preview version, tour the preview against the container's recording (unrecorded requests, missing files, new console errors, sideways overflow at six sizes, every header), and promote only on a pass. Jobs that install dev dependencies hold no token.
• Run the workflow from the release for stable versions; it skips when the Cloudflare secrets are unset.
• Keep the token out of build output: the upload job checks out scripts/demo/wrangler.jsonc from the repository, accepts only web files (no links, dotfiles, node_modules, package*.json or Wrangler config) from the build artifact, and passes the token to curl on stdin.
• Create a missing Worker with a placeholder page before the first upload, and serialise release and manual runs in one concurrency group.
• Record write routes with a valid body, record Export, retry a failed replay download, reload a page whose recording a newer release replaced, and fail verification when Save, Test or Export show a different result than the container.

Testing
All green. Added 21 tests; the full pipeline passed against the 1.18.0 image on a local Workers server and failed on a dropped answer, a weakened header, a wrong Test result and a missing Export.

Changelog

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.