Add checked workspace-interface query roots

Implement scoped interface extents across QX, generated bindings, SDK,
Orch, Camino and browser queries. Preserve native projection, aggregation,
pagination and watch invalidation without synthetic persisted objects.
Validate exact query grants and scope freshness on execution and replay.
Add local PostgreSQL, transport, browser and code-generation coverage.

C1 implementation slice only: full-text indexes and Studio search adoption
(C2/C3) remain tracked in the implementation handoff. No publication or deployment.

proto/camino/api.proto

@@ -241,7 +241,10 @@ message CaminoOp {
 
 message QueryRequest {
   string query_id = 1;
-  string object_id = 2;
+  oneof root {
+    string object_id = 2;
+    quixos.WorkspaceQueryScope workspace_scope = 5;
+  }
   map<string, Value> variables = 3;
   // Typed callers require this exact checked definition. Administrative/raw
   // callers may omit it to explicitly select the currently installed definition.
@@ -351,7 +354,10 @@ message QueryFieldFailure {
 }
 message QueryChangesRequest {
   string query_id = 1;
-  string object_id = 2;
+  oneof root {
+    string object_id = 2;
+    quixos.WorkspaceQueryScope workspace_scope = 4;
+  }
   string data_version = 3;
 }
 message QueryChangesResponse {

proto/camino/schema.proto

@@ -286,6 +286,15 @@ message QueryReadBinding {
   Cardinality cardinality = 13;
   string key_type = 14;
 }
+// Checked schema survives even when no atom currently implements an interface.
+message QueryFieldContract {
+  string interface_revision_id = 1;
+  string member_id = 2;
+  string field_name = 3;
+  string value_type_json = 4;
+  Cardinality cardinality = 5;
+  string key_type = 6;
+}
 message QueryBudgets {
   uint32 rows = 1;
   uint32 depth = 2;
@@ -299,7 +308,10 @@ message InstalledQuery {
   string id = 1;
   string definition_digest = 2;
   string binding_digest = 3;
-  string root_interface_revision_id = 4;
+  oneof root {
+    string object_interface = 4;
+    string workspace_interface = 14;
+  }
   repeated QuerySelection selection = 5;
   repeated QueryReadBinding bindings = 6;
   QueryBudgets budgets = 7;
@@ -309,4 +321,6 @@ message InstalledQuery {
   bool watch = 11;
   uint32 polling_interval_ms = 12;
   bool rpc_predicate_or_order = 13;
+  repeated string root_atom_ids = 15;
+  repeated QueryFieldContract fields = 16;
 }

proto/quixos/orch.proto

@@ -145,6 +145,7 @@ message QueryDescription {
   repeated string source_files = 6;
   string effects_json = 7;
   camino.InstalledQuery plan = 8;
+  WorkspaceQueryScope workspace_scope = 9;
 }
 message ClassCapability {
   string conformance_id = 1;

proto/quixos/refs.proto

@@ -44,12 +44,27 @@ message InjectedDependency {
     string interface_revision_id = 4;
     string constructor_atom_id = 5;
     string query_id = 7;
+    WorkspaceQueryDependency workspace_query = 8;
   }
   // Defaults to the invocation receiver. A checked dependency traversal can
   // select a related object explicitly before the package runtime starts.
   string object_id = 6;
 }
 
+// Scope evidence is not authority by itself. The caller must also hold the
+// matching workspace-query grant (or the authenticated workspace user grant).
+message WorkspaceQueryScope {
+  string workspace_id = 1;
+  string workspace_revision_id = 2;
+  string workspace_epoch = 3;
+  string interface_revision_id = 4;
+  string binding_digest = 5;
+}
+message WorkspaceQueryDependency {
+  string query_id = 1;
+  WorkspaceQueryScope scope = 2;
+}
+
 message EdgeDependency {
   string edge_type_id = 1;
   string projection_id = 2;