Add activated workspace reflection and Studio definition watches

Expose bounded snapshot-bound definition reads and latest-only watches from the serving checked bundle. Add checked reflection dependency ports, generated SDK bindings and selector-scoped invocation authority.

Move Studio factory, contract and query discovery to public reflection inventories. Share an active-definition watch across canvas and standalone routes and invalidate/reload on epoch changes instead of polling GetWorkspace.

Document the API and deferred scope; cover compiler/codegen, SDK injection, transport authorization, activation publication, pagination and reconnect behavior. Keep all work local; no deployment or publication.

proto/quixos/refs.proto

@@ -45,12 +45,19 @@ message InjectedDependency {
     string constructor_atom_id = 5;
     string query_id = 7;
     WorkspaceQueryDependency workspace_query = 8;
+    ReflectionDependency reflection = 9;
   }
   // Defaults to the invocation receiver. A checked dependency traversal can
   // select a related object explicitly before the package runtime starts.
   string object_id = 6;
 }
 
+message ReflectionDependency {
+  string workspace_id = 1;
+  string workspace_epoch = 2;
+  repeated string selectors = 3;
+}
+
 // Scope evidence is not authority by itself. The caller must also hold the
 // matching workspace-query grant (or the authenticated workspace user grant).
 message WorkspaceQueryScope {