Add the workspace coding agent, launch gate, and composable locks

- run a singleton Codex App Server adapter in each dev workspace
- gate Web Studio with a reloadable fragment-token to HttpOnly-session exchange
- add ChatGPT device login and streamed chat to Web Studio
- isolate authoring access in a declarative NixOS service account
- split Web Studio canvas, object, panel, and model concerns
- check generated Quixos protocol clients for drift
- resolve same-repository quixos.lock fragments deterministically
- preserve the collaborative canvas gesture fixes

test/fixtures/owned.interface.qx

@@ -0,0 +1,10 @@
+import interface Named;
+
+interface Owned id "interface:owned" revision "interface:owned@1" {
+  relation owner id "member:owned:owner" : exactly-one interface Named {
+    resolve id "operation:owned:owner:resolve";
+    connect id "operation:owned:owner:connect";
+    disconnect id "operation:owned:owner:disconnect";
+    watch start id "operation:owned:owner:watch-start" stop id "operation:owned:owner:watch-stop";
+  }
+}