Instrument and improve incremental workspace checks

Profile source capture, Nix evaluation/realization, resource/query checking,
and implementation builds without putting timings into immutable outputs.
Keep modular repositories; bound independent capture work, snapshot jj once
per observation, and retain final concurrent-edit and Git completeness checks.

Compose exact resource/closure/frontend/toolchain checks as memoized Nix
derivations. Preserve whole-workspace validation and the full compiler path
when no checked dependency is supplied. Share canonical Nixpkgs by content,
index workspace build contexts once, and narrow lock/driver/compiler inputs
with conservative complete-source fallback. Batch React witness checks only
when distinct source closures cannot share ambient declarations; otherwise
run the original independent TypeScript checks.

Seed local authoring toolchains with exact canonical fetch identities when
they match the selected inputs; retain store-path inputs for overrides.
Add generic correctness checks rather than permanent Reader timing/content
fixtures. Verify actual Reader edits and rejection/recovery in a private
workbench, preserving the original user's workbench and runtime.

Query checking currently caches at resource/closure boundaries, not individual
query semantic dependency boundaries. Template helper pins and reproducible
fixture snapshots follow in a separate publication change.

nix/lock-source.test.nix

@@ -0,0 +1,42 @@
+{ pkgs, protocol }:
+let
+  base = ''quixos-lock version 1 { quixos source { repository "https://example.test/quixos.git"; commit "1111111111111111111111111111111111111111"; } }'';
+  fixture =
+    extra: lock:
+    pkgs.runCommand "qx-lock-source-fixture" { } ''
+      mkdir -p "$out/nested"
+      printf '%s' ${pkgs.lib.escapeShellArg lock} > "$out/quixos.lock"
+      printf '%s' ${pkgs.lib.escapeShellArg extra} > "$out/implementation.ts"
+      printf '%s' 'quixos-lock fragment version 1 {}' > "$out/nested/dependencies.txt"
+    '';
+  first = fixture "first implementation" base;
+  edited = fixture "edited implementation" base;
+  changed = fixture "first implementation" (
+    builtins.replaceStrings
+      [ "1111111111111111111111111111111111111111" ]
+      [ "2222222222222222222222222222222222222222" ]
+      base
+  );
+  fragments = fixture "first implementation" (
+    builtins.replaceStrings [ "quixos source" ] [ ''import "nested/dependencies.txt"; quixos source'' ]
+      base
+  );
+  conservative = fixture "first implementation" (base + "\n// import in a comment\n");
+  slice = source: import ./lock-source.nix { inherit source; };
+  parse =
+    source:
+    pkgs.runCommand "qx-source-lock.json" { } ''
+      ${protocol}/bin/quixos-lock-check ${slice source}/quixos.lock > "$out"
+    '';
+in
+assert slice first == slice edited;
+assert (parse first).drvPath == (parse edited).drvPath;
+assert slice first != slice changed;
+pkgs.runCommand "qx-lock-source-check" { } ''
+  ${protocol}/bin/quixos-lock-check ${slice first}/quixos.lock > first.json
+  ${protocol}/bin/quixos-lock-check ${slice edited}/quixos.lock > edited.json
+  cmp first.json edited.json
+  ${protocol}/bin/quixos-lock-check ${slice conservative}/quixos.lock > comment.json
+  cmp first.json comment.json
+  ${protocol}/bin/quixos-lock-check ${slice fragments}/quixos.lock > "$out"
+''