Instrument and improve incremental workspace checks

Profile source capture, Nix evaluation/realization, resource/query checking,
and implementation builds without putting timings into immutable outputs.
Keep modular repositories; bound independent capture work, snapshot jj once
per observation, and retain final concurrent-edit and Git completeness checks.

Compose exact resource/closure/frontend/toolchain checks as memoized Nix
derivations. Preserve whole-workspace validation and the full compiler path
when no checked dependency is supplied. Share canonical Nixpkgs by content,
index workspace build contexts once, and narrow lock/driver/compiler inputs
with conservative complete-source fallback. Batch React witness checks only
when distinct source closures cannot share ambient declarations; otherwise
run the original independent TypeScript checks.

Seed local authoring toolchains with exact canonical fetch identities when
they match the selected inputs; retain store-path inputs for overrides.
Add generic correctness checks rather than permanent Reader timing/content
fixtures. Verify actual Reader edits and rejection/recovery in a private
workbench, preserving the original user's workbench and runtime.

Query checking currently caches at resource/closure boundaries, not individual
query semantic dependency boundaries. Template helper pins and reproducible
fixture snapshots follow in a separate publication change.

src/capability-language/checked-resources.ts

@@ -0,0 +1,40 @@
+import { readFile } from "node:fs/promises";
+import type { CheckedResourceResolver } from "./assembly.js";
+import type { CapabilityResource } from "./parser.js";
+
+/** Internal compiler inputs produced by checked-candidate.nix, not authoring
+ * receipts. The Nix composition owns their derivations and exact toolchain.
+ * Ordinary compiler callers omit this map and run all checks directly. */
+export async function loadCheckedResources(filename?: string): Promise<CheckedResourceResolver | undefined> {
+  if (!filename) return undefined;
+  const entries = JSON.parse(await readFile(filename, "utf8")) as Array<{
+    kind: string;
+    repository: string;
+    commit: string;
+    artifact: string;
+  }>;
+  const resources = new Map<string, string>();
+  for (const entry of entries) {
+    const key = `${entry.kind}\0${entry.repository}\0${entry.commit}`;
+    if (resources.has(key)) throw new Error("Repeated checked resource input");
+    if (!/^\/nix\/store\/[^/]+$/.test(entry.artifact))
+      throw new Error("Checked resources must be immutable Nix outputs");
+    resources.set(key, entry.artifact);
+  }
+  return async (kind, source, lock, dependencies) => {
+    const artifact = resources.get(`${kind}\0${source.repository}\0${source.commit}`);
+    if (!artifact) return undefined;
+    const graph = JSON.parse(await readFile(`${artifact}/graph.json`, "utf8"));
+    const expected = [...dependencies].map(([binding, node]) => ({ binding, resourceKey: node.key }));
+    if (
+      graph.quixos.commit !== lock.quixos.commit ||
+      graph.quixos.repository !== lock.quixos.repository ||
+      graph.root.kind !== kind ||
+      graph.root.source.repository !== source.repository ||
+      graph.root.source.commit !== source.commit ||
+      JSON.stringify(graph.root.dependencies) !== JSON.stringify(expected)
+    )
+      throw new Error("Checked resource input does not match its locked dependency graph");
+    return JSON.parse(await readFile(`${artifact}/candidate.json`, "utf8")) as CapabilityResource;
+  };
+}