feat(storage): move desktop SQLite ownership into a storage utility process

Main no longer opens desktop business SQLite. A single utility-process
storage owner holds the Assistant, Knowledge, attachment, document-result,
remote-binding and native model-ledger databases and runs whole domain
transactions; Main and Runtime callers use explicit async domain operations.

- Remove the Main readWithFallback path and the supervision worker's
  separate business write connection; manifests are scanned read-only and
  committed by the sole writer.
- Remote events are ACKed only after commit; process loss reports
  unconfirmed writes instead of replaying them.
- Use native utilityProcess messaging with one in-flight bound (32) and
  ordered waiting instead of capacity rejection and retries.
- Start the storage process before the window so startup overlaps.
- Keep short tool output in memory and store full output once in owned
  storage; paging, branching, restart and deletion reuse that copy.
- Put required runtime launch files under goodbuddy-prefixed owned temp
  directories and reclaim confirmed stale ones; stop writing duplicate
  parsed.md.
- Add lint guards for SQLite ownership and architecture, concurrency
  acceptance fixtures, and maintenance/architecture documentation.

Validation: typecheck and lint pass. Alternating baseline (edf019aa) vs
candidate runs show no regression on single-session, C01, C02, C04 and a
5-minute C06; Main p99 drops from ~21 ms to ~16.7 ms under concurrency.
Fresh portable copy (1.75M events) upgrade content unchanged; real-model
output paging passes with 4 external requests. Full npm test runs had
1-9 different timing-sensitive failures per run that pass when rerun.
Not covered: C03 review publication, C07 source body, app-level C05.

src/main/agent/direct-model-ripgrep.test.ts

@@ -1,5 +1,5 @@
 import { mkdtemp, mkdir, rm, symlink, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
+import { FileOutputBacking, outputFixtureRoot } from '../../../tests/support/paged-output-backing'
 import { join } from 'node:path'
 import { rgPath } from '@vscode/ripgrep'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
@@ -10,14 +10,18 @@ import { searchWorkspaceWithRipgrep } from './direct-model-ripgrep'
 let root: string
 let workspace: LocalWorkspaceAccess
 let service: LocalDirectModelProcessService
+let backingStore: FileOutputBacking
 beforeEach(async () => {
-  root = await mkdtemp(join(tmpdir(), 'goodbuddy-rg-'))
+  await mkdir(outputFixtureRoot, { recursive: true })
+  root = await mkdtemp(join(outputFixtureRoot, 'rg-'))
   workspace = new LocalWorkspaceAccess(root)
-  service = new LocalDirectModelProcessService()
+  backingStore = new FileOutputBacking()
+  service = new LocalDirectModelProcessService({ outputStore: { backingStore } })
   await writeFile(join(root, 'valid.txt'), 'before\ntarget\nafter\n')
 })
 afterEach(async () => {
   await service.dispose()
+  await backingStore.dispose()
   await rm(root, { recursive: true, force: true })
 })
 const search = (args: string[], signal = new AbortController().signal) =>
@@ -71,7 +75,7 @@ describe('native ripgrep', () => {
     } finally { await configured.dispose() }
   })
   it('allows external paths and directory links with current-user permissions', async () => {
-    const outside = await mkdtemp(join(tmpdir(), 'goodbuddy-rg-outside-'))
+    const outside = await mkdtemp(join(outputFixtureRoot, 'rg-outside-'))
     try {
       await writeFile(join(outside, 'outside.txt'), 'target\n')
       await symlink(outside, join(root, 'linked'), process.platform === 'win32' ? 'junction' : 'dir')