Add checked workspace-interface query roots

Implement scoped interface extents across QX, generated bindings, SDK,
Orch, Camino and browser queries. Preserve native projection, aggregation,
pagination and watch invalidation without synthetic persisted objects.
Validate exact query grants and scope freshness on execution and replay.
Add local PostgreSQL, transport, browser and code-generation coverage.

C1 implementation slice only: full-text indexes and Studio search adoption
(C2/C3) remain tracked in the implementation handoff. No publication or deployment.

test/queries.test.mjs

@@ -37,12 +37,51 @@ test("query ports carry only an injected query identity and root", async () => {
   );
   await context.query("list").execute({ first: jsToProtoValue(30) }, "checked-definition");
   assert.equal(seen.expectedDefinitionDigest, "checked-definition");
-  assert.equal(seen.objectId, "obj:collection");
+  assert.deepEqual(seen.root, { case: "objectId", value: "obj:collection" });
   assert.equal(seen.queryId, "pkg@1:upcoming");
   assert.equal(protoValueToJs(seen.variables.first), 30);
   assert.throws(() => context.query("not-injected"), /Missing/);
 });
 
+test("workspace query ports carry explicit scoped evidence, never their receiver", async () => {
+  let seen;
+  const dependency = create(InjectedDependencySchema, {
+    portId: "search",
+    binding: {
+      case: "workspaceQuery",
+      value: {
+        queryId: "pkg@1:search",
+        scope: {
+          workspaceId: "ws",
+          workspaceRevisionId: "ws@1",
+          workspaceEpoch: "1",
+          interfaceRevisionId: "searchable",
+          bindingDigest: "digest",
+        },
+      },
+    },
+  });
+  const context = createRuntimeContext(
+    {},
+    {
+      executeQuery: async (request) => {
+        seen = request;
+        return create(QueryResponseSchema);
+      },
+    },
+    { objectId: "obj:receiver", input: {}, dependencies: [dependency] },
+  );
+  await context.query("search").execute({});
+  assert.equal(seen.root.case, "workspaceScope");
+  assert.equal(seen.root.value.workspaceId, "ws");
+  assert.equal(seen.objectId, undefined);
+  dependency.binding.value.scope = undefined;
+  assert.throws(
+    () => createRuntimeContext({}, {}, { objectId: "obj:receiver", input: {}, dependencies: [dependency] }),
+    /has no scope/,
+  );
+});
+
 test("query snapshots distinguish an unavailable scalar from a successful null", () => {
   const output = {
     kind: "record",