Add the workspace coding agent, launch gate, and composable locks

- run a singleton Codex App Server adapter in each dev workspace
- gate Web Studio with a reloadable fragment-token to HttpOnly-session exchange
- add ChatGPT device login and streamed chat to Web Studio
- isolate authoring access in a declarative NixOS service account
- split Web Studio canvas, object, panel, and model concerns
- check generated Quixos protocol clients for drift
- resolve same-repository quixos.lock fragments deterministically
- preserve the collaborative canvas gesture fixes

flake.lock

@@ -74,17 +74,17 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1788581083,
-        "narHash": "sha256-d+2xgaR/f/9b2AwXqEba2SnO7marqCEpwAT5kUIF8a4=",
-        "ref": "refs/tags/quixos-reachability/fd6160ec67c0c93a61f7f605c4c1397c95c6369b",
-        "rev": "fd6160ec67c0c93a61f7f605c4c1397c95c6369b",
-        "revCount": 35,
+        "lastModified": 1788655747,
+        "narHash": "sha256-fMICRR8ICPp/Li55DPQI35RroDO9bsv4jiLvIkPyvYY=",
+        "ref": "refs/tags/quixos-reachability/eabf721e9429a6dcd8db8cdcc078f96868b655aa",
+        "rev": "eabf721e9429a6dcd8db8cdcc078f96868b655aa",
+        "revCount": 38,
         "type": "git",
         "url": "https://gitea-external.egads.tutti.syntaxblitz.net/quixos/quixos-protocol.git"
       },
       "original": {
-        "ref": "refs/tags/quixos-reachability/fd6160ec67c0c93a61f7f605c4c1397c95c6369b",
-        "rev": "fd6160ec67c0c93a61f7f605c4c1397c95c6369b",
+        "ref": "refs/tags/quixos-reachability/eabf721e9429a6dcd8db8cdcc078f96868b655aa",
+        "rev": "eabf721e9429a6dcd8db8cdcc078f96868b655aa",
         "type": "git",
         "url": "https://gitea-external.egads.tutti.syntaxblitz.net/quixos/quixos-protocol.git"
       }