Add activated workspace reflection and Studio definition watches

Expose bounded snapshot-bound definition reads and latest-only watches from the serving checked bundle. Add checked reflection dependency ports, generated SDK bindings and selector-scoped invocation authority.

Move Studio factory, contract and query discovery to public reflection inventories. Share an active-definition watch across canvas and standalone routes and invalidate/reload on epoch changes instead of polling GetWorkspace.

Document the API and deferred scope; cover compiler/codegen, SDK injection, transport authorization, activation publication, pagination and reconnect behavior. Keep all work local; no deployment or publication.

dist/quixos/refs_pb.d.ts

@@ -176,6 +176,12 @@ export type InjectedDependency = Message<"quixos.InjectedDependency"> & {
          */
         value: WorkspaceQueryDependency;
         case: "workspaceQuery";
+    } | {
+        /**
+         * @generated from field: quixos.ReflectionDependency reflection = 9;
+         */
+        value: ReflectionDependency;
+        case: "reflection";
     } | {
         case: undefined;
         value?: undefined;
@@ -193,6 +199,28 @@ export type InjectedDependency = Message<"quixos.InjectedDependency"> & {
  * Use `create(InjectedDependencySchema)` to create a new message.
  */
 export declare const InjectedDependencySchema: GenMessage<InjectedDependency>;
+/**
+ * @generated from message quixos.ReflectionDependency
+ */
+export type ReflectionDependency = Message<"quixos.ReflectionDependency"> & {
+    /**
+     * @generated from field: string workspace_id = 1;
+     */
+    workspaceId: string;
+    /**
+     * @generated from field: string workspace_epoch = 2;
+     */
+    workspaceEpoch: string;
+    /**
+     * @generated from field: repeated string selectors = 3;
+     */
+    selectors: string[];
+};
+/**
+ * Describes the message quixos.ReflectionDependency.
+ * Use `create(ReflectionDependencySchema)` to create a new message.
+ */
+export declare const ReflectionDependencySchema: GenMessage<ReflectionDependency>;
 /**
  * Scope evidence is not authority by itself. The caller must also hold the
  * matching workspace-query grant (or the authenticated workspace user grant).