Add the workspace coding agent, launch gate, and composable locks

- run a singleton Codex App Server adapter in each dev workspace
- gate Web Studio with a reloadable fragment-token to HttpOnly-session exchange
- add ChatGPT device login and streamed chat to Web Studio
- isolate authoring access in a declarative NixOS service account
- split Web Studio canvas, object, panel, and model concerns
- check generated Quixos protocol clients for drift
- resolve same-repository quixos.lock fragments deterministically
- preserve the collaborative canvas gesture fixes

src/resource-lock/cli.ts

@@ -1,6 +1,5 @@
 #!/usr/bin/env node
-import { readFile } from "node:fs/promises";
-import { parseQuixosLock } from "./parser.js";
+import { loadQuixosLock } from "./loader.js";
 
 const fileName = process.argv[2];
 if (!fileName || process.argv.length !== 3) {
@@ -8,7 +7,7 @@ if (!fileName || process.argv.length !== 3) {
   process.exit(2);
 }
 
-const result = parseQuixosLock(await readFile(fileName, "utf8"), fileName);
+const result = await loadQuixosLock(fileName);
 if (!result.ok) {
   for (const diagnostic of result.diagnostics) {
     console.error(