Add the workspace coding agent, launch gate, and composable locks

- run a singleton Codex App Server adapter in each dev workspace
- gate Web Studio with a reloadable fragment-token to HttpOnly-session exchange
- add ChatGPT device login and streamed chat to Web Studio
- isolate authoring access in a declarative NixOS service account
- split Web Studio canvas, object, panel, and model concerns
- check generated Quixos protocol clients for drift
- resolve same-repository quixos.lock fragments deterministically
- preserve the collaborative canvas gesture fixes

package.json

@@ -6,6 +6,8 @@
   "type": "module",
   "bin": {
     "quixos-capability-compile": "dist/src/capability-language/cli.js",
+    "quixos-resource-compile": "dist/src/capability-language/resource-cli.js",
+    "quixos-workspace-compile": "dist/src/capability-language/workspace-cli.js",
     "quixos-descriptor-check": "dist/src/descriptor-check.js",
     "quixos-lock-check": "dist/src/resource-lock/cli.js"
   },