Add checked workspace-interface query roots

Implement scoped interface extents across QX, generated bindings, SDK,
Orch, Camino and browser queries. Preserve native projection, aggregation,
pagination and watch invalidation without synthetic persisted objects.
Validate exact query grants and scope freshness on execution and replay.
Add local PostgreSQL, transport, browser and code-generation coverage.

C1 implementation slice only: full-text indexes and Studio search adoption
(C2/C3) remain tracked in the implementation handoff. No publication or deployment.

grammar/QuixosCapability.g4

@@ -147,7 +147,7 @@ packageExport
   ;
 
 packageQuery
-  : QUERY identifier typeParameters? ID stringLiteral ROOT interfaceType
+  : QUERY identifier typeParameters? ID stringLiteral ROOT WORKSPACE? interfaceType
     DOCUMENT stringLiteral OPERATION stringLiteral LBRACE queryClause* RBRACE
   ;
 
@@ -328,7 +328,7 @@ dependencyBinding
   | identifier TO EDGE identifier DOT identifier (VIA EDGE identifier DOT identifier)? SEMI
   | identifier TO INTERFACE identifier typeArguments? (VIA EDGE identifier DOT identifier)? SEMI
   | identifier TO CONSTRUCTOR identifier SEMI
-  | identifier TO QUERY identifier DOT identifier (VIA EDGE identifier DOT identifier)? SEMI
+  | identifier TO WORKSPACE? QUERY identifier DOT identifier (VIA EDGE identifier DOT identifier)? SEMI
   ;
 
 constructorBindingDecl