Add checked workspace-interface query roots

Implement scoped interface extents across QX, generated bindings, SDK,
Orch, Camino and browser queries. Preserve native projection, aggregation,
pagination and watch invalidation without synthetic persisted objects.
Validate exact query grants and scope freshness on execution and replay.
Add local PostgreSQL, transport, browser and code-generation coverage.

C1 implementation slice only: full-text indexes and Studio search adoption
(C2/C3) remain tracked in the implementation handoff. No publication or deployment.

proto/camino/api.proto

@@ -241,7 +241,10 @@ message CaminoOp {
 
 message QueryRequest {
   string query_id = 1;
-  string object_id = 2;
+  oneof root {
+    string object_id = 2;
+    quixos.WorkspaceQueryScope workspace_scope = 5;
+  }
   map<string, Value> variables = 3;
   // Typed callers require this exact checked definition. Administrative/raw
   // callers may omit it to explicitly select the currently installed definition.
@@ -351,7 +354,10 @@ message QueryFieldFailure {
 }
 message QueryChangesRequest {
   string query_id = 1;
-  string object_id = 2;
+  oneof root {
+    string object_id = 2;
+    quixos.WorkspaceQueryScope workspace_scope = 4;
+  }
   string data_version = 3;
 }
 message QueryChangesResponse {