So, you'll go up at trail and present a bunch of data points, and build a narrative around those data points. Look, you say, I had good reviews from my managers and glowing recommendations from my co-workers. Despite this, I was fired shortly after I Did A Thing. Is this a coincidence or retaliatory? Your employer would attempt to provide evidence that your work quality actually dropped off, you would attempt to present evidence that either the quality stayed the same, or else that goalposts were moved for no good reason.

Note that both parties have the ability to compel various types of evidence to be produced. You would be able to subpeona the employer for emails between bosses, or manager notes, or reviews and such. You could be able to compel people to testify around a variety of facts.

... if this process sounds rather onerous, now you know why trials take a long time and many parties prefer to settle privately rather than engage in the full court process.

Curiously, this is a standard that isn't well understood. It's "beyond a reasonable doubt", not "any doubt whatsoever". You saw it a lot in some of the Bitcoin cases (Silk Road)... "Well, they can't prove that he wasn't set up or that the wallet matching his wasn't entirely a coincidence, (crypto signatures be damned), so there's doubt, and he should be acquitted".

They demoted two employees who were highly performing, weren't told otherwise, but coincidentally highly instrumental in organizing and staging protests. Doesn't take a genius to figure out why they were forcibly transferred.

This doesn't meet the standards for burden of proof.

There could be an email trail, or testimony from witnesses to conversations in which the motivations were discussed. That's direct evidence.

There could also be indirect evidence, for example, if there was a pattern of firing employees directly after they participated in protected activities.

Courts deal with mens rea and actus rea every day. They look at the evidence and see if it meets the burden of proof.