Consolidate Reader source ownership and pinned application instances

Add exact recursive source checkout, independent Git/jj developer workbenches and source-only backup/recovery commands, with Workspace instance binding outside source. Qualify two empty Reader Graphs, packaged source commands, Agent VM compilation, exact Gitea read grants and reconciled Reader settings/annotation stability. Publish checked Reader Package/root revisions to canonical review branches and retention tags, retain all 57 repositories independently in private versioned storage, verify downloaded-backup recovery and advance the example pin.

Add bounded Central pin acquisition and selection-specific read-only identities, qualified against all 57 canonical repositories without write authority. Replace regex fork dependency discovery with compiler-parsed lock imports and rewrite proposals; preserve source identities and unrelated files, passing instance binding through packed and ordinary host checks.

Hosted run-pin versus authoring preparation and maintained duplicate removal remain pending. Live source selections, Template defaults and default source branches are unchanged.

nix/checked-candidate.nix

@@ -6,6 +6,7 @@
   kind,
   generator,
   contractOnly ? false,
+  workspaceId ? null,
   system ? builtins.currentSystem,
 }:
 let
@@ -164,6 +165,11 @@ let
               ${queryGeneratorFlags root} \
               --checked-resources ${checkedResources node} \
               --source-root-commit ${pkgs.lib.escapeShellArg node.commit} \
+              ${
+                pkgs.lib.optionalString (
+                  workspaceId != null
+                ) "--workspace-id ${pkgs.lib.escapeShellArg workspaceId}"
+              } \
               --checkout-root "$TMPDIR/checkouts" --snapshot-map ${snapshots node} \
               --graph-out "$out/graph.json" --schemas-out "$out/package-schemas.json" \
               ${
@@ -357,6 +363,13 @@ let
     )
   );
 in
+assert
+  workspaceId == null
+  || (
+    kind == "workspace"
+    && builtins.isString workspaceId
+    && builtins.match "[a-zA-Z0-9][a-zA-Z0-9:._-]{0,255}" workspaceId != null
+  );
 pkgs.runCommand (if contractOnly then "qx-contract" else "qx-checked-candidate") { } ''
   mkdir -p "$out"
   cp ${