feat(storage): move desktop SQLite ownership into a storage utility process

Main no longer opens desktop business SQLite. A single utility-process
storage owner holds the Assistant, Knowledge, attachment, document-result,
remote-binding and native model-ledger databases and runs whole domain
transactions; Main and Runtime callers use explicit async domain operations.

- Remove the Main readWithFallback path and the supervision worker's
  separate business write connection; manifests are scanned read-only and
  committed by the sole writer.
- Remote events are ACKed only after commit; process loss reports
  unconfirmed writes instead of replaying them.
- Use native utilityProcess messaging with one in-flight bound (32) and
  ordered waiting instead of capacity rejection and retries.
- Start the storage process before the window so startup overlaps.
- Keep short tool output in memory and store full output once in owned
  storage; paging, branching, restart and deletion reuse that copy.
- Put required runtime launch files under goodbuddy-prefixed owned temp
  directories and reclaim confirmed stale ones; stop writing duplicate
  parsed.md.
- Add lint guards for SQLite ownership and architecture, concurrency
  acceptance fixtures, and maintenance/architecture documentation.

Validation: typecheck and lint pass. Alternating baseline (edf019aa) vs
candidate runs show no regression on single-session, C01, C02, C04 and a
5-minute C06; Main p99 drops from ~21 ms to ~16.7 ms under concurrency.
Fresh portable copy (1.75M events) upgrade content unchanged; real-model
output paging passes with 4 external requests. Full npm test runs had
1-9 different timing-sensitive failures per run that pass when rerun.
Not covered: C03 review publication, C07 source body, app-level C05.

docs/features/document-processing/http-paddleocr-vl-technical-design.md

@@ -116,13 +116,11 @@ confidence 改为可选，保持本地返回原值；多块内容组成逐页 se
       original.<ext>
     documents/<attachmentId>/
       original.<ext>
-      parsed.md
       manifest.json
       images/<imageId>.<ext>
   knowledge/<kbId>/<sourceId>/
     <managed-original-files>
   knowledge-assets/<kbId>/<documentId>/
-    parsed.md
     manifest.json
     images/<imageId>.<ext>
   temp/document-parsing/<operationId>/
@@ -155,7 +153,7 @@ confidence 改为可选，保持本地返回原值；多块内容组成逐页 se
 也需验证同一规则。采用暂存、现有事务和按数据库引用核对清理，不新增恢复引擎。
 
 测试解析使用任务临时目录，结束预览且无有效引用后清理。知识库正文及 chunks 继续存数据库，
-`knowledge-assets` 的 `parsed.md` 为解析正文文件，随同一次结果提交保持一致，不独立修改
+`knowledge-assets` 的 `manifest.json` 保存解析正文，随同一次结果提交保持一致，不独立修改
 或替代数据库中的检索内容。图片归知识库文档所有，不依赖聊天存活；managed 与 reference
 派生文件均存该目录，reference 外部原件保持原路径，现有 managed 原件目录不迁移。
 重解析或同步先在本次暂存目录完成新结果与必要资源校验，成功提交替换后清理无引用旧资源；

docs/features/document-processing/implementation.md

@@ -44,17 +44,21 @@ PPTX 回退提示按实际 OCR 来源显示，并在图片处理失败时包含
   conversation-assets/<conversationId>/
     images/<resourceId>/original.<ext>
     documents/<resourceId>/original.<ext>
-    documents/<resourceId>/parsed.md
     documents/<resourceId>/manifest.json
     documents/<resourceId>/images/<imageId>
   knowledge/<libraryId>/<sourceId>/<managed-original>
   knowledge-assets/<libraryId>/<documentId>/<resultId>/
-    parsed.md
     manifest.json
     images/<imageId>
   temp/document-parsing/<resourceId>/
 ```
 
+S04 (2026-10-05): new results store parsed content in `manifest.json` only;
+`parsed.md` is no longer written or copied. Released manifests remain readable,
+including directories containing the old duplicate. Async storage-host integration
+and its remaining composition work are specified in
+[Desktop File Storage Integration](../../architecture/desktop-storage-files.md).
+
 会话资产的 `request.json` 保存已转换的请求内容，用于恢复内存 context；原件字节单独保存，
 缩放和 JPEG 请求副本不覆盖原图。提取图片文件使用 UUID 无扩展名，MIME 在清单记录。
 图片显式 OCR 后生成解析文件。切回原图保留已有结果，并重新进入图片能力校验。