Instrument and improve incremental workspace checks

Profile source capture, Nix evaluation/realization, resource/query checking,
and implementation builds without putting timings into immutable outputs.
Keep modular repositories; bound independent capture work, snapshot jj once
per observation, and retain final concurrent-edit and Git completeness checks.

Compose exact resource/closure/frontend/toolchain checks as memoized Nix
derivations. Preserve whole-workspace validation and the full compiler path
when no checked dependency is supplied. Share canonical Nixpkgs by content,
index workspace build contexts once, and narrow lock/driver/compiler inputs
with conservative complete-source fallback. Batch React witness checks only
when distinct source closures cannot share ambient declarations; otherwise
run the original independent TypeScript checks.

Seed local authoring toolchains with exact canonical fetch identities when
they match the selected inputs; retain store-path inputs for overrides.
Add generic correctness checks rather than permanent Reader timing/content
fixtures. Verify actual Reader edits and rejection/recovery in a private
workbench, preserving the original user's workbench and runtime.

Query checking currently caches at resource/closure boundaries, not individual
query semantic dependency boundaries. Template helper pins and reproducible
fixture snapshots follow in a separate publication change.

nix/lock-source.nix

@@ -0,0 +1,16 @@
+# Lock parsing only reads this one file when no import token can occur. A
+# conservative substring probe also sends comments/URLs containing "import"
+# through the complete-source path. Fragment names may have any extension.
+{ source }:
+let
+  regular = ((builtins.readDir source)."quixos.lock" or null) == "regular";
+  text = if regular then builtins.readFile (source + "/quixos.lock") else "import";
+in
+if builtins.replaceStrings [ "import" ] [ "" ] text != text then
+  source
+else
+  builtins.path {
+    path = source;
+    name = "qx-lock-source";
+    filter = filename: _: filename == toString source || filename == "${source}/quixos.lock";
+  }