Add the workspace coding agent, launch gate, and composable locks

- run a singleton Codex App Server adapter in each dev workspace
- gate Web Studio with a reloadable fragment-token to HttpOnly-session exchange
- add ChatGPT device login and streamed chat to Web Studio
- isolate authoring access in a declarative NixOS service account
- split Web Studio canvas, object, panel, and model concerns
- check generated Quixos protocol clients for drift
- resolve same-repository quixos.lock fragments deterministically
- preserve the collaborative canvas gesture fixes

grammar/QuixosCapability.g4

@@ -2,6 +2,8 @@ grammar QuixosCapability;
 
 document
   : workspaceDecl EOF
+  | interfaceResourceDecl EOF
+  | packageResourceDecl EOF
   ;
 
 workspaceDecl
@@ -11,29 +13,40 @@ workspaceDecl
 
 workspaceItem
   : atomDecl
-  | interfaceDecl
-  | packageDecl
+  | resourceImportDecl
   | sharedAttachmentDecl
   | conformanceDecl
   | constructorBindingDecl
   ;
 
+resourceImportDecl
+  : IMPORT INTERFACE identifier SEMI
+  | IMPORT PACKAGE identifier SEMI
+  ;
+
+externalAtomDecl
+  : EXTERNAL ATOM identifier ID stringLiteral SEMI
+  ;
+
+externalInterfaceDecl
+  : EXTERNAL INTERFACE identifier REVISION stringLiteral SEMI
+  ;
+
+resourcePreamble
+  : resourceImportDecl
+  | externalAtomDecl
+  | externalInterfaceDecl
+  ;
+
 atomDecl
   : ATOM identifier ID stringLiteral (DOC stringLiteral)? SEMI
   ;
 
-interfaceDecl
-  : INTERFACE identifier ID stringLiteral REVISION stringLiteral sourceBlock
+interfaceResourceDecl
+  : resourcePreamble* INTERFACE identifier ID stringLiteral REVISION stringLiteral
     LBRACE interfaceMember* RBRACE
   ;
 
-sourceBlock
-  : SOURCE LBRACE
-    REPOSITORY stringLiteral SEMI
-    COMMIT stringLiteral SEMI
-    RBRACE
-  ;
-
 interfaceMember
   : valueMember
   | relationshipMember
@@ -73,8 +86,8 @@ targetConstraint
   | INTERFACE identifier
   ;
 
-packageDecl
-  : PACKAGE identifier ID stringLiteral REVISION stringLiteral sourceBlock
+packageResourceDecl
+  : resourcePreamble* PACKAGE identifier ID stringLiteral REVISION stringLiteral
     LBRACE packageExport* RBRACE
   ;
 
@@ -237,7 +250,7 @@ dependencyBindingBlock
 dependencyBinding
   : identifier TO STATE identifier (VIA EDGE identifier DOT identifier)? SEMI
   | identifier TO EDGE identifier DOT identifier (VIA EDGE identifier DOT identifier)? SEMI
-  | identifier TO INTERFACE identifier SEMI
+  | identifier TO INTERFACE identifier (VIA EDGE identifier DOT identifier)? SEMI
   | identifier TO CONSTRUCTOR identifier SEMI
   ;
 
@@ -307,6 +320,8 @@ stringLiteral
   ;
 
 WORKSPACE: 'workspace';
+IMPORT: 'import';
+EXTERNAL: 'external';
 ATOM: 'atom';
 INTERFACE: 'interface';
 INTERFACES: 'interfaces';