Add checked workspace-interface query roots

Implement scoped interface extents across QX, generated bindings, SDK,
Orch, Camino and browser queries. Preserve native projection, aggregation,
pagination and watch invalidation without synthetic persisted objects.
Validate exact query grants and scope freshness on execution and replay.
Add local PostgreSQL, transport, browser and code-generation coverage.

C1 implementation slice only: full-text indexes and Studio search adoption
(C2/C3) remain tracked in the implementation handoff. No publication or deployment.

test/query-workspace.test.ts

@@ -2,6 +2,7 @@ import assert from "node:assert/strict";
 import test from "node:test";
 import { queryWorkspaceFixture } from "./fixtures/query-workspace.js";
 import { linkQueries } from "../src/query/link.js";
+import { compileQuery } from "../src/query/compile.js";
 
 test("query fixture links generic collections, both implementations, and native getter/RPC setter", async () => {
   const { workspace } = await queryWorkspaceFixture();
@@ -27,3 +28,27 @@ test("query fixture links generic collections, both implementations, and native
   const totals = workspace.linkedQueries.find((q) => q.id.endsWith(":totals"))!;
   assert.equal(totals.fields.filter((f) => f.memberId === "rank").length, 2);
 });
+
+test("reference-only workspace queries hash every eligible conformance, including empty atoms", async () => {
+  const { workspace } = await queryWorkspaceFixture();
+  const pkg = workspace.packageImports.find((pkg) => pkg.queries?.some((q) => q.id === "upcoming"))!;
+  const query = pkg.queries!.find((q) => q.id === "upcoming")!;
+  const contract = workspace.interfaceImports.find((iface) => iface.displayName === "TaskFacts")!;
+  query.root = { kind: "workspace-interface", interface: contract.revisionId };
+  query.fragments = [];
+  const checked = await compileQuery(
+    query,
+    workspace.interfaceImports,
+    async () => `query ${query.operation} {root {objects(first: 10) {entries {node {_qx {ref}}}}}}`,
+  );
+  pkg.checkedQueries = pkg.checkedQueries!.map((q) => (q.declaration.id === query.id ? checked : q));
+  const linked = linkQueries(workspace).find((q) => q.id.endsWith(":upcoming"))!;
+  assert.equal(linked.fields.length, 0);
+  assert.equal(linked.rootAtoms.length, 2);
+  workspace.conformances = workspace.conformances.filter(
+    (c) => !(c.atomId === linked.rootAtoms[0] && c.interfaceRevisionId === contract.revisionId),
+  );
+  const changed = linkQueries(workspace).find((q) => q.id === linked.id)!;
+  assert.equal(changed.rootAtoms.length, 1);
+  assert.notEqual(linked.bindingDigest, changed.bindingDigest);
+});