Instrument and improve incremental workspace checks

Profile source capture, Nix evaluation/realization, resource/query checking,
and implementation builds without putting timings into immutable outputs.
Keep modular repositories; bound independent capture work, snapshot jj once
per observation, and retain final concurrent-edit and Git completeness checks.

Compose exact resource/closure/frontend/toolchain checks as memoized Nix
derivations. Preserve whole-workspace validation and the full compiler path
when no checked dependency is supplied. Share canonical Nixpkgs by content,
index workspace build contexts once, and narrow lock/driver/compiler inputs
with conservative complete-source fallback. Batch React witness checks only
when distinct source closures cannot share ambient declarations; otherwise
run the original independent TypeScript checks.

Seed local authoring toolchains with exact canonical fetch identities when
they match the selected inputs; retain store-path inputs for overrides.
Add generic correctness checks rather than permanent Reader timing/content
fixtures. Verify actual Reader edits and rejection/recovery in a private
workbench, preserving the original user's workbench and runtime.

Query checking currently caches at resource/closure boundaries, not individual
query semantic dependency boundaries. Template helper pins and reproducible
fixture snapshots follow in a separate publication change.

src/capability-language/workspace-cli.ts

@@ -5,6 +5,8 @@ import process from "node:process";
 import { compileWorkspaceRepository } from "./assembly.js";
 import { createGitCapabilityResolver } from "./git-resolver.js";
 import { loadQueryGenerator } from "./query-generator.js";
+import { loadCheckedResources } from "./checked-resources.js";
+import { profile } from "./profile.js";
 import { compileExecutionPlan, packageBuildContexts } from "../execution-world/index.js";
 import { bindingSchema, specializeBindingSchema } from "../bindings/index.js";
 import {
@@ -18,7 +20,7 @@ const usage = `usage: quixos-workspace-compile --root DIRECTORY --checkout-root
        [--snapshot-map PATH] [--graph-out PATH] [--workspace-id ID] [--workspace-revision-id ID]
        [--source-root-commit GIT_REV] [--baseline PLAN_JSON] [--evolution-out PATH]
        [--reviews REVIEW_JSON] [--schemas-out PATH] [--execution-plan-out PATH] [--build-contexts-out PATH]
-       [--query-generator BUILD_MODULE_PATH]
+       [--query-generator BUILD_MODULE_PATH] [--checked-resources NIX_MAP]
 
 Resolves a workspace's recursive resource-lock graph, clones every exact
 resource revision, validates standalone interface/package manifests, and emits
@@ -50,6 +52,7 @@ const parseArgs = (args: string[]) => {
     evolutionOut: values.get("--evolution-out"),
     reviews: values.get("--reviews"),
     queryGenerator: values.get("--query-generator"),
+    checkedResources: values.get("--checked-resources"),
   };
 };
 
@@ -63,6 +66,7 @@ const main = async () => {
     checkoutRoot: options.checkoutRoot,
     snapshotMap: options.snapshotMap,
   });
+  const assemblyStarted = performance.now();
   const assembled = await compileWorkspaceRepository({
     rootDirectory: options.rootDirectory,
     workspaceId: options.workspaceId,
@@ -70,7 +74,9 @@ const main = async () => {
     sourceRootCommit: options.sourceRootCommit,
     resolveResource,
     generateQueries: await loadQueryGenerator(options.queryGenerator),
+    checkedResource: await loadCheckedResources(options.checkedResources),
   });
+  profile("workspace-assembly", assemblyStarted, { resources: assembled.resources.length });
 
   if (options.graphOut) {
     await writeFile(
@@ -110,12 +116,15 @@ const main = async () => {
   }
   const candidate = { ...assembled.workspace, executionContracts: runtimeContracts(assembled.workspace) };
   if (options.executionPlanOut || options.buildContextsOut) {
+    const executionStarted = performance.now();
     const plan = compileExecutionPlan(assembled.workspace);
     if (options.executionPlanOut) await writeFile(options.executionPlanOut, `${JSON.stringify(plan, null, 2)}\n`);
     if (options.buildContextsOut)
       await writeFile(options.buildContextsOut, JSON.stringify(packageBuildContexts(plan.definition.bindingSchema)));
+    profile("execution-plan-and-contexts", executionStarted);
   }
   if (options.schemasOut) {
+    const schemasStarted = performance.now();
     const schemas: Record<string, unknown> = {};
     for (const node of assembled.capabilityResources.filter((entry) => entry.kind === "package")) {
       const closure = new Map<string, typeof node>();
@@ -133,6 +142,7 @@ const main = async () => {
       );
     }
     await writeFile(options.schemasOut, JSON.stringify(schemas));
+    profile("package-schemas", schemasStarted);
   }
   if (options.evolutionOut) {
     const baseline = options.baseline