Add the workspace coding agent, launch gate, and composable locks

- run a singleton Codex App Server adapter in each dev workspace
- gate Web Studio with a reloadable fragment-token to HttpOnly-session exchange
- add ChatGPT device login and streamed chat to Web Studio
- isolate authoring access in a declarative NixOS service account
- split Web Studio canvas, object, panel, and model concerns
- check generated Quixos protocol clients for drift
- resolve same-repository quixos.lock fragments deterministically
- preserve the collaborative canvas gesture fixes

test/fixtures/todo.capabilities.qx

@@ -2,50 +2,10 @@ workspace Todo id "workspace:todo" revision "workspace:todo@1" commit "111111111
   atom Project id "atom:project" doc "A project containing work.";
   atom Person id "atom:person";
 
-  interface Named id "interface:named" revision "interface:named@1" source {
-    repository "https://repos.quixos.org/quixos-todo/interface-named.git";
-    commit "2222222222222222222222222222222222222222";
-  } {
-    value name id "member:named:name" : string {
-      get id "operation:named:name:get";
-      set id "operation:named:name:set";
-      watch start id "operation:named:name:watch-start" stop id "operation:named:name:watch-stop";
-    }
-  }
-
-  interface Owned id "interface:owned" revision "interface:owned@1" source {
-    repository "https://repos.quixos.org/quixos-todo/interface-owned.git";
-    commit "3333333333333333333333333333333333333333";
-  } {
-    relation owner id "member:owned:owner" : exactly-one interface Named {
-      resolve id "operation:owned:owner:resolve";
-      connect id "operation:owned:owner:connect";
-      disconnect id "operation:owned:owner:disconnect";
-      watch start id "operation:owned:owner:watch-start" stop id "operation:owned:owner:watch-stop";
-    }
-  }
-
-  interface Summary id "interface:summary" revision "interface:summary@1" source {
-    repository "https://repos.quixos.org/quixos-todo/interface-summary.git";
-    commit "4444444444444444444444444444444444444444";
-  } {
-    value summary id "member:summary:summary" : string {
-      get id "operation:summary:summary:get";
-    }
-  }
-
-  package TodoRuntime id "package:todo-runtime" revision "package:todo-runtime@1" source {
-    repository "https://repos.quixos.org/quixos-todo/package-todo-runtime.git";
-    commit "5555555555555555555555555555555555555555";
-  } {
-    operation summaryGet id "export:todo-runtime:summary-get" : unit -> string
-      mode call receiver interfaces [Named] requires {
-        state title id "port:summary:title" : string [read];
-        interface named id "port:summary:named" : Named;
-        constructor person id "port:summary:person" : Person;
-      };
-    constructor createPerson id "export:todo-runtime:create-person" constructs Person : unit;
-  }
+  import interface Named;
+  import interface Owned;
+  import interface Summary;
+  import package TodoRuntime;
 
   shared state ProjectTitle id "slot:project:title" on Project : string
     policy optimistic-register default "Untitled project";