Add checked workspace-interface query roots

Implement scoped interface extents across QX, generated bindings, SDK,
Orch, Camino and browser queries. Preserve native projection, aggregation,
pagination and watch invalidation without synthetic persisted objects.
Validate exact query grants and scope freshness on execution and replay.
Add local PostgreSQL, transport, browser and code-generation coverage.

C1 implementation slice only: full-text indexes and Studio search adoption
(C2/C3) remain tracked in the implementation handoff. No publication or deployment.

dist/camino/api_pb.d.ts

@@ -1,6 +1,6 @@
 import type { GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
 import type { PersistencePlan, QueryRelationalPlan, QuerySelection } from "./schema_pb.js";
-import type { CapabilityRef, FieldEditing } from "../quixos/refs_pb.js";
+import type { CapabilityRef, FieldEditing, WorkspaceQueryScope } from "../quixos/refs_pb.js";
 import type { Message } from "@bufbuild/protobuf";
 /**
  * Describes the file camino/api.proto.
@@ -915,9 +915,24 @@ export type QueryRequest = Message<"camino.QueryRequest"> & {
      */
     queryId: string;
     /**
-     * @generated from field: string object_id = 2;
+     * @generated from oneof camino.QueryRequest.root
      */
-    objectId: string;
+    root: {
+        /**
+         * @generated from field: string object_id = 2;
+         */
+        value: string;
+        case: "objectId";
+    } | {
+        /**
+         * @generated from field: quixos.WorkspaceQueryScope workspace_scope = 5;
+         */
+        value: WorkspaceQueryScope;
+        case: "workspaceScope";
+    } | {
+        case: undefined;
+        value?: undefined;
+    };
     /**
      * @generated from field: map<string, camino.Value> variables = 3;
      */
@@ -1370,9 +1385,24 @@ export type QueryChangesRequest = Message<"camino.QueryChangesRequest"> & {
      */
     queryId: string;
     /**
-     * @generated from field: string object_id = 2;
+     * @generated from oneof camino.QueryChangesRequest.root
      */
-    objectId: string;
+    root: {
+        /**
+         * @generated from field: string object_id = 2;
+         */
+        value: string;
+        case: "objectId";
+    } | {
+        /**
+         * @generated from field: quixos.WorkspaceQueryScope workspace_scope = 4;
+         */
+        value: WorkspaceQueryScope;
+        case: "workspaceScope";
+    } | {
+        case: undefined;
+        value?: undefined;
+    };
     /**
      * @generated from field: string data_version = 3;
      */

dist/camino/schema_pb.d.ts

@@ -1071,6 +1071,42 @@ export type QueryReadBinding = Message<"camino.QueryReadBinding"> & {
  * Use `create(QueryReadBindingSchema)` to create a new message.
  */
 export declare const QueryReadBindingSchema: GenMessage<QueryReadBinding>;
+/**
+ * Checked schema survives even when no atom currently implements an interface.
+ *
+ * @generated from message camino.QueryFieldContract
+ */
+export type QueryFieldContract = Message<"camino.QueryFieldContract"> & {
+    /**
+     * @generated from field: string interface_revision_id = 1;
+     */
+    interfaceRevisionId: string;
+    /**
+     * @generated from field: string member_id = 2;
+     */
+    memberId: string;
+    /**
+     * @generated from field: string field_name = 3;
+     */
+    fieldName: string;
+    /**
+     * @generated from field: string value_type_json = 4;
+     */
+    valueTypeJson: string;
+    /**
+     * @generated from field: camino.Cardinality cardinality = 5;
+     */
+    cardinality: Cardinality;
+    /**
+     * @generated from field: string key_type = 6;
+     */
+    keyType: string;
+};
+/**
+ * Describes the message camino.QueryFieldContract.
+ * Use `create(QueryFieldContractSchema)` to create a new message.
+ */
+export declare const QueryFieldContractSchema: GenMessage<QueryFieldContract>;
 /**
  * @generated from message camino.QueryBudgets
  */
@@ -1126,9 +1162,24 @@ export type InstalledQuery = Message<"camino.InstalledQuery"> & {
      */
     bindingDigest: string;
     /**
-     * @generated from field: string root_interface_revision_id = 4;
+     * @generated from oneof camino.InstalledQuery.root
      */
-    rootInterfaceRevisionId: string;
+    root: {
+        /**
+         * @generated from field: string object_interface = 4;
+         */
+        value: string;
+        case: "objectInterface";
+    } | {
+        /**
+         * @generated from field: string workspace_interface = 14;
+         */
+        value: string;
+        case: "workspaceInterface";
+    } | {
+        case: undefined;
+        value?: undefined;
+    };
     /**
      * @generated from field: repeated camino.QuerySelection selection = 5;
      */
@@ -1167,6 +1218,14 @@ export type InstalledQuery = Message<"camino.InstalledQuery"> & {
      * @generated from field: bool rpc_predicate_or_order = 13;
      */
     rpcPredicateOrOrder: boolean;
+    /**
+     * @generated from field: repeated string root_atom_ids = 15;
+     */
+    rootAtomIds: string[];
+    /**
+     * @generated from field: repeated camino.QueryFieldContract fields = 16;
+     */
+    fields: QueryFieldContract[];
 };
 /**
  * Describes the message camino.InstalledQuery.