Add the workspace coding agent, launch gate, and composable locks

- run a singleton Codex App Server adapter in each dev workspace
- gate Web Studio with a reloadable fragment-token to HttpOnly-session exchange
- add ChatGPT device login and streamed chat to Web Studio
- isolate authoring access in a declarative NixOS service account
- split Web Studio canvas, object, panel, and model concerns
- check generated Quixos protocol clients for drift
- resolve same-repository quixos.lock fragments deterministically
- preserve the collaborative canvas gesture fixes

dist/quixos/orch_pb.d.ts

@@ -100,6 +100,13 @@ export type InvokeCapabilityRequest = Message<"quixos.orch.InvokeCapabilityReque
     input: {
         [key: string]: Value;
     };
+    /**
+     * Identifies one logical client mutation across the capability and Camino
+     * layers so a live-value controller can recognize its own confirmation.
+     *
+     * @generated from field: string client_mutation_id = 4;
+     */
+    clientMutationId: string;
 };
 /**
  * Describes the message quixos.orch.InvokeCapabilityRequest.
@@ -130,6 +137,10 @@ export type InvokeCapabilityResponse = Message<"quixos.orch.InvokeCapabilityResp
      * @generated from field: string error = 5;
      */
     error: string;
+    /**
+     * @generated from field: repeated quixos.runtime.DerivedDependency dependencies = 6;
+     */
+    dependencies: DerivedDependency[];
 };
 /**
  * Describes the message quixos.orch.InvokeCapabilityResponse.