Add the workspace coding agent, launch gate, and composable locks

- run a singleton Codex App Server adapter in each dev workspace
- gate Web Studio with a reloadable fragment-token to HttpOnly-session exchange
- add ChatGPT device login and streamed chat to Web Studio
- isolate authoring access in a declarative NixOS service account
- split Web Studio canvas, object, panel, and model concerns
- check generated Quixos protocol clients for drift
- resolve same-repository quixos.lock fragments deterministically
- preserve the collaborative canvas gesture fixes

grammar/QuixosLock.g4

@@ -1,7 +1,8 @@
 grammar QuixosLock;
 
 document
-  : QUIXOS_LOCK VERSION INTEGER LBRACE quixosEntry resourceEntry* RBRACE EOF
+  : QUIXOS_LOCK FRAGMENT? VERSION INTEGER LBRACE
+    (quixosEntry | importEntry | resourceEntry)* RBRACE EOF
   ;
 
 quixosEntry
@@ -12,6 +13,10 @@ resourceEntry
   : resourceKind identifier SOURCE sourceBlock
   ;
 
+importEntry
+  : IMPORT stringLiteral SEMI
+  ;
+
 resourceKind
   : INTERFACE
   | PACKAGE
@@ -33,6 +38,7 @@ stringLiteral
   ;
 
 QUIXOS_LOCK: 'quixos-lock';
+FRAGMENT: 'fragment';
 VERSION: 'version';
 QUIXOS: 'quixos';
 SOURCE: 'source';
@@ -40,6 +46,7 @@ INTERFACE: 'interface';
 PACKAGE: 'package';
 REPOSITORY: 'repository';
 COMMIT: 'commit';
+IMPORT: 'import';
 
 LBRACE: '{';
 RBRACE: '}';