Add activated workspace reflection and Studio definition watches

Expose bounded snapshot-bound definition reads and latest-only watches from the serving checked bundle. Add checked reflection dependency ports, generated SDK bindings and selector-scoped invocation authority.

Move Studio factory, contract and query discovery to public reflection inventories. Share an active-definition watch across canvas and standalone routes and invalidate/reload on epoch changes instead of polling GetWorkspace.

Document the API and deferred scope; cover compiler/codegen, SDK injection, transport authorization, activation publication, pagination and reconnect behavior. Keep all work local; no deployment or publication.

test/bindings.test.ts

@@ -12,6 +12,17 @@ const schemaFor = (body: string): BindingSchema => {
   if (!compiled.ok || compiled.resource.kind !== "package") throw new Error("expected package");
   return { format: "quixos-bindings", version: 1, interfaces: [], packages: [compiled.resource.revision] };
 };
+test("reflection ports generate explicit selector-restricted package bindings", () => {
+  const schema = schemaFor(
+    'function inspect id "inspect" : unit -> unit requires { reflection meta id "meta" [active, atoms, interfaces, conformances, queries, indexes]; };',
+  );
+  const generated = generateTypeScriptBindings(schema, "demo@1");
+  assert.match(
+    generated,
+    /QxReflectionPort<"active" \| "atoms" \| "interfaces" \| "conformances" \| "queries" \| "indexes">/,
+  );
+  assert.match(generated, /"kind": "reflection"/);
+});
 test("generator uses exact IDs, restricted ports, nominal references, and lossless scalar types", () => {
   const schema = schemaFor(
     'operation run id "run-id" : list<int64> -> optional<atom-ref<Thing>> mode call receiver atom Thing requires { state payload id "payload-id" : bytes [read]; };',