Is it possible for a device watch face to play a sound or vibrate?

The Attention Module is not available in watch faces.

From the API Doc:

https://developer.garmin.com/connect-iq/api-docs/Toybox/Attention.html

App Types:

• Watch App

• Audio Content Provider

• Data Field

• Widget

What's the workaround?

No work around.  You can't play tones or vibrate in a watch face. (or turn on/off the backlight).

Gosh, that's a serious limitation.

What can do those things, device apps only?

That's a pity, as presumably that was in the days before GPS and Music which must use substantially more battery than a mere vibrate.

Even downloading a Spotify playlist consumes more than 10% battery in around 10 minute, without asking, something a dozen vibrates a minute would never come close to achieving.

Perhaps the permission should finally be granted to Watch Faces too?

Understand that watch faces are very battery friendly (or should be) as they are running 24/7.  The things you mention are known to be much more battery hungry and users understand they may need to charge the device after using them.

fwiw I've asked numerous times as well to add the functionality to watch faces as I can see several good use cases for this (and I disagree with the battery argument, there's nobody that will have buzz the watch face all day)

It never hurts to file a feature request in the bug reports forum https://forums.garmin.com/developer/connect-iq/i/bug-reports  to ask for the vibrate functionality to be added to watch faces. 

Describe in the feature request the use case for what you want to use it, the better you document this, the higher your chances are that it's being reconsidered.

I'll upvote your request.

As Garmin has said in the past, part of the issue is there would be no control.  While playing a short beep at the top of the hour would have minimal impact, there would be more if long tone sequences were used or it the tone was played more often.  And things like turning on the backlight for extended periods would for sure.

As you may know I've said before Jim, this is also a non argument, if they are (truly) afraid of misuse it's easy to implement restrictions by time / duration / amount of times per day. 

But I don't think that's even necessary as there's no one that would misuse it (misuse rules out itself with an uninstall of the watch face).