Add the workspace coding agent, launch gate, and composable locks

- run a singleton Codex App Server adapter in each dev workspace
- gate Web Studio with a reloadable fragment-token to HttpOnly-session exchange
- add ChatGPT device login and streamed chat to Web Studio
- isolate authoring access in a declarative NixOS service account
- split Web Studio canvas, object, panel, and model concerns
- check generated Quixos protocol clients for drift
- resolve same-repository quixos.lock fragments deterministically
- preserve the collaborative canvas gesture fixes

dist/quixos/runtime_pb.d.ts

@@ -90,6 +90,10 @@ export type InvokeResponse = Message<"quixos.runtime.InvokeResponse"> & {
      * @generated from field: string error = 3;
      */
     error: string;
+    /**
+     * @generated from field: repeated quixos.runtime.DerivedDependency dependencies = 4;
+     */
+    dependencies: DerivedDependency[];
 };
 /**
  * Describes the message quixos.runtime.InvokeResponse.