Add the workspace coding agent, launch gate, and composable locks

- run a singleton Codex App Server adapter in each dev workspace
- gate Web Studio with a reloadable fragment-token to HttpOnly-session exchange
- add ChatGPT device login and streamed chat to Web Studio
- isolate authoring access in a declarative NixOS service account
- split Web Studio canvas, object, panel, and model concerns
- check generated Quixos protocol clients for drift
- resolve same-repository quixos.lock fragments deterministically
- preserve the collaborative canvas gesture fixes

test/capability-model.test.ts

@@ -92,7 +92,7 @@ test("the representative v1 workspace compiles to native and package plans", ()
       summary.dependencies.map((entry) => [entry.port.id, entry.binding.kind]),
       [
         [fixtureId.titlePort, "state"],
-        [fixtureId.namedPort, "receiver-interface"],
+        [fixtureId.namedPort, "interface"],
         [fixtureId.personPort, "constructor"],
       ],
     );
@@ -164,6 +164,25 @@ test("private attachments are visible only to their owning conformance", () => {
   expectIssue(workspace, "private-attachment-access");
 });
 
+test("related-object dependency views cannot traverse another conformance's private edge", () => {
+  const workspace = makeValidCapabilityWorkspace();
+  const packageBinding = conformance(
+    workspace,
+    fixtureId.projectSummaryConformance,
+  ).operationBindings[0]!.binding;
+  assert.equal(packageBinding.kind, "package");
+  if (packageBinding.kind !== "package") return;
+  const named = packageBinding.dependencies.find(
+    (dependency) => dependency.portId === fixtureId.namedPort,
+  );
+  assert.ok(named && named.binding.kind === "interface");
+  named.binding.via = {
+    edgeTypeId: fixtureId.projectOwner,
+    projectionId: fixtureId.projectOwnerProjection,
+  };
+  expectIssue(workspace, "private-attachment-access");
+});
+
 test("native state and edge providers must match operation shape", () => {
   const stateWorkspace = makeValidCapabilityWorkspace();
   const state = conformance(