Add the workspace coding agent, launch gate, and composable locks

- run a singleton Codex App Server adapter in each dev workspace
- gate Web Studio with a reloadable fragment-token to HttpOnly-session exchange
- add ChatGPT device login and streamed chat to Web Studio
- isolate authoring access in a declarative NixOS service account
- split Web Studio canvas, object, panel, and model concerns
- check generated Quixos protocol clients for drift
- resolve same-repository quixos.lock fragments deterministically
- preserve the collaborative canvas gesture fixes

test/fixtures/todo.package.qx

@@ -0,0 +1,12 @@
+import interface Named;
+external atom Person id "atom:person";
+
+package TodoRuntime id "package:todo-runtime" revision "package:todo-runtime@1" {
+  operation summaryGet id "export:todo-runtime:summary-get" : unit -> string
+    mode call receiver interfaces [Named] requires {
+      state title id "port:summary:title" : string [read];
+      interface named id "port:summary:named" : Named;
+      constructor person id "port:summary:person" : Person;
+    };
+  constructor createPerson id "export:todo-runtime:create-person" constructs Person : unit;
+}