Owner-controlled workspace export and restore for agents, channels, workflows, memories, and history

## Problem

Buzz’s open protocol and self-hosting reduce lock-in, but an owner still lacks one supported way to export and restore the complete working state of a human–agent workspace. A platform migration or disaster recovery plan should not require reconstructing agent identities, prompts, memories, workflows, channels, canvases, memberships, and conversation history from separate internal stores.

The existing audit-export request in #3228 is important but narrower: it exports the tamper-evident audit chain, not the operational workspace state needed to resume work elsewhere.

## Proposed Behavior

Provide an owner-authorized, versioned export and restore contract for:

- community and channel metadata;
- membership and role assignments;
- managed-agent personas and configuration, including prompts and model/runtime references;
- agent memory records;
- workflows and schedules;
- canvases, projects, issues, and other durable workspace objects;
- messages, threads, reactions, and attachment manifests;
- hosted repository metadata and references.

The export should:

- use a documented, versioned format with a signed manifest and checksums;
- exclude private keys, provider tokens, credentials, and other secrets by default;
- identify content that is referenced but not embedded, such as external files or provider-side state;
- support bounded or incremental export for large histories;
- support restore dry-run, collision reporting, identity and channel remapping, and post-restore verification;
- work for hosted-to-self-hosted, self-hosted-to-hosted, and same-relay disaster recovery where authorization permits.

## Acceptance Criteria

- An owner can export a representative workspace without direct database access.
- A dry-run restore reports collisions, missing external dependencies, and excluded secrets before writing.
- A verified restore recreates the documented durable state with stable provenance and no cross-community leakage.
- Secret material is never included unless a separate explicit and secure key-export workflow is designed.
- The export format and compatibility policy are documented and regression tested.

## Non-Goals

- Capturing an agent process’s in-memory execution state.
- Exporting third-party provider data Buzz does not own.
- Replacing the verifiable audit-chain export proposed in #3228.

## Duplicate Check

Searched the current issue queue for `workspace export`, `backup restore`, and `migration` on August 12, 2026. No open issue covered a complete owner-controlled workspace export-and-restore contract.

The issue names no implementation files or tests; start by mapping the existing workspace stores and the narrower audit export in #3228. Define the versioned export, authorization, secret-exclusion, dry-run, restore, and verification boundaries from the acceptance criteria. Done means a documented and regression-tested contract supports safe export and verified restore without cross-community leakage.

Written by the indexing model from the issue text.