Consolidate Reader source ownership and pinned application instances

Add exact recursive source checkout, independent Git/jj developer workbenches and source-only backup/recovery commands, with Workspace instance binding outside source. Qualify two empty Reader Graphs, packaged source commands, Agent VM compilation, exact Gitea read grants and reconciled Reader settings/annotation stability. Publish checked Reader Package/root revisions to canonical review branches and retention tags, retain all 57 repositories independently in private versioned storage, verify downloaded-backup recovery and advance the example pin.

Add bounded Central pin acquisition and selection-specific read-only identities, qualified against all 57 canonical repositories without write authority. Replace regex fork dependency discovery with compiler-parsed lock imports and rewrite proposals; preserve source identities and unrelated files, passing instance binding through packed and ordinary host checks.

Hosted run-pin versus authoring preparation and maintained duplicate removal remain pending. Live source selections, Template defaults and default source branches are unchanged.

src/capability-language/checked-build.ts

@@ -112,7 +112,10 @@ export async function buildImmutableCandidate(
   logFile: string,
   contractOnly = false,
   observe?: (phase: "nixEvaluationMs" | "nixBuildMs", ms: number) => void,
+  workspaceId?: string,
 ): Promise<string> {
+  if (workspaceId !== undefined && (kind !== "workspace" || !/^[a-zA-Z0-9][a-zA-Z0-9:._-]{0,255}$/.test(workspaceId)))
+    throw new Error("Instance binding requires a valid Workspace identity and a Workspace root");
   if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(source.commit))
     throw new Error("An immutable candidate requires an exact commit");
   const url = new URL(source.repository);
@@ -200,6 +203,7 @@ export async function buildImmutableCandidate(
         "--arg",
         "contractOnly",
         contractOnly ? "true" : "false",
+        ...(workspaceId === undefined ? [] : ["--argstr", "workspaceId", workspaceId]),
         "--add-root",
         gcRoot,
         "--indirect",