Make workspace authoring converge through immutable Nix candidates

Coordinate registered resource edits bottom-up into retained exact remote sources.
Use one Nix-owned source graph for provisional checking, template publication,
explicit baseline upgrades and host activation; retain independent runtime pins.

Add scoped contract inspection, historical recovery, derived worklists, crash-safe
locks, named dependency adoption and plain-QX structural editing. Repair TODO
ownership and template instantiation, and document the supported agent workflow.

Validated with protocol and command suites, real jj/Nix convergence and cache
checks, TS/React installed-command acceptance, and fresh TODO first-edit acceptance.
No live deployment or public publication performed. Props projection generation
and a one-command rich feature generator remain explicitly outside this delivery.

src/capability-model/validation.ts

@@ -1467,8 +1467,12 @@ const validateConformances = (
           );
           continue;
         }
-        validateAttachmentAccess(issues, attachment, conformance, `${bindingPath}.binding.edgeTypeId`);
         const projection = edgeProjection(attachment.attachment, binding.projectionId);
+        // An owned endpoint may explicitly export read-only traversal, including
+        // a native inverse relationship view. This never exports mutation rights.
+        if (!(binding.primitive === "resolve" && projection?.endpoint.publicTraversal)) {
+          validateAttachmentAccess(issues, attachment, conformance, `${bindingPath}.binding.edgeTypeId`);
+        }
         const relationshipMember = operationEntry.member.kind === "relationship"
           ? operationEntry.member
           : undefined;