Version history and restore

Every Durable Object draft save and publish already creates an immutable document-version record. TenantWorkspaceDocumentStore now exposes that history through listVersions(siteId) and supports restoreDraft(siteId, sourceVersion, expectedDraftVersion, actor).

Restore never overwrites a draft in place. It reads the selected immutable version, verifies the current draft version for optimistic concurrency, and saves the restored document as a new draft version attributed to the actor. A later publish remains an explicit, separately authorized action.

The private MCP draft_restore_version operation places restore behind the guarded command ledger, optimistic expected version, and explicit human confirmation. AI plan application records both its source and result versions, so an authorized reviewer can identify the exact rollback source. Restore itself creates a provenance entry and remains reversible because it produces another immutable draft version.

Version history is tenant-local to the Durable Object. On managed hosting, the Astro administration route sends a fixed list query or restore command through the hostname-selected tenant Worker; neither accepts a tenant or site selector. The Worker authorizes content.view before listing history and content.edit before restoring, while confirmation, optimistic concurrency, idempotency, and audit remain inside the tenant-local command boundary. The object deliberately receives only the already-authorized actor ID.