Unify workspace authoring, verification and scaffolding workflows

Use exact jj snapshots and one candidate-bound Nix builder for incremental checks, template validation and activation. Keep provenance internal and separate recovery checkpoint failures from local command success.

Provision workspace-scoped managed package/interface repositories with recoverable Central effects. Add TypeScript/React presets, function and dependency commands, and scaffold enrollment for all TODO packages. Install authoring guides and controlled Codex sandbox rules.

Invalidate module resolutions across cutover, including in-flight races, and content-address host platform entries. Strengthen domain-model and verification instructions.

Validated real jj/Nix authoring, React/Slate dependency installation, bottom-up local Git publication, packaged CLI tests, PostgreSQL recovery/auth tests, Web Studio tests and host configuration. Public protocol/helpers and the validated 19-resource TODO template are published. Retained the approved exact private baseline and updated the installation's default template pin to 68d54f0d52be433ebf60bdc1faf7646c57f90307. Master and live deployments remain unchanged. See docs/WORKSPACE_AUTHORING_PROGRESS.md.

flake.nix

@@ -19,6 +19,8 @@
             pkgs.esbuild
             pkgs.protobuf
             pkgs.git
+            pkgs.jujutsu
+            pkgs.gnutar
           ];
           buildPhase = ''
             runHook preBuild
@@ -60,6 +62,7 @@
           installPhase = ''
             runHook preInstall
             mkdir -p "$out"
+            install -Dm644 nix/checked-package.nix "$out/share/checked-package.nix"
             cp --reflink=auto --recursive grammar "$out/grammar"
             cp --reflink=auto --recursive proto "$out/proto"
             cp --reflink=auto --recursive dist "$out/dist"