Make workspace authoring converge through immutable Nix candidates

Coordinate registered resource edits bottom-up into retained exact remote sources.
Use one Nix-owned source graph for provisional checking, template publication,
explicit baseline upgrades and host activation; retain independent runtime pins.

Add scoped contract inspection, historical recovery, derived worklists, crash-safe
locks, named dependency adoption and plain-QX structural editing. Repair TODO
ownership and template instantiation, and document the supported agent workflow.

Validated with protocol and command suites, real jj/Nix convergence and cache
checks, TS/React installed-command acceptance, and fresh TODO first-edit acceptance.
No live deployment or public publication performed. Props projection generation
and a one-command rich feature generator remain explicitly outside this delivery.

test/nix-candidate.test.ts

@@ -0,0 +1,34 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { execFile as callback } from "node:child_process";
+import { promisify } from "node:util";
+const execFile = promisify(callback);
+
+test("Nix checks a retained immutable source without a local overlay and reuses the result", {skip: !process.env.QX_CHECK_GENERATOR}, async context => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "qx-nix-candidate-test-"));
+  context.after(() => fs.rm(root, {recursive: true, force: true}));
+  const git = (...args: string[]) => execFile("git", ["-C", root, ...args]);
+  await git("init");
+  await fs.writeFile(path.join(root, "interface.qx"), 'interface Example id "interface:example" revision "interface:example@1" {}');
+  await fs.writeFile(path.join(root, "quixos.lock"), `quixos-lock version 1 { quixos source { repository "https://example.test/quixos"; commit "${"a".repeat(40)}"; } }`);
+  await git("add", ".");
+  await git("-c", "user.name=Test", "-c", "user.email=test@example.test", "commit", "-m", "contract");
+  const commit = (await git("rev-parse", "HEAD")).stdout.trim();
+  await git("tag", `quixos-reachability/${commit}`);
+  const generator = process.env.QX_CHECK_GENERATOR!;
+  const repository = "https://immutable-candidate.example.test/contract.git";
+  const env = {...process.env, GIT_CONFIG_COUNT: "1", GIT_CONFIG_KEY_0: `url.file://${root}.insteadOf`, GIT_CONFIG_VALUE_0: repository};
+  const build = async () => (await execFile("nix", ["build", "--impure", "--file", path.join(generator, "share/checked-candidate.nix"),
+    "--argstr", "repository", repository, "--argstr", "commit", commit,
+    "--argstr", "kind", "interface", "--argstr", "generator", generator,
+    "--option", "substitute", "false", "--no-link", "--print-out-paths"], {env, maxBuffer: 4 * 1024 * 1024})).stdout.trim();
+  const output = await build();
+  const candidate = JSON.parse(await fs.readFile(path.join(output, "candidate.json"), "utf8"));
+  assert.equal(candidate.revision.source.commit, commit);
+  await fs.writeFile(path.join(root, "interface.qx"), "broken draft");
+  assert.equal(await build(), output);
+  assert.deepEqual(JSON.parse(await fs.readFile(path.join(output, "checks.json"), "utf8")), []);
+});