feat(storage): move desktop SQLite ownership into a storage utility process

Main no longer opens desktop business SQLite. A single utility-process
storage owner holds the Assistant, Knowledge, attachment, document-result,
remote-binding and native model-ledger databases and runs whole domain
transactions; Main and Runtime callers use explicit async domain operations.

- Remove the Main readWithFallback path and the supervision worker's
  separate business write connection; manifests are scanned read-only and
  committed by the sole writer.
- Remote events are ACKed only after commit; process loss reports
  unconfirmed writes instead of replaying them.
- Use native utilityProcess messaging with one in-flight bound (32) and
  ordered waiting instead of capacity rejection and retries.
- Start the storage process before the window so startup overlaps.
- Keep short tool output in memory and store full output once in owned
  storage; paging, branching, restart and deletion reuse that copy.
- Put required runtime launch files under goodbuddy-prefixed owned temp
  directories and reclaim confirmed stale ones; stop writing duplicate
  parsed.md.
- Add lint guards for SQLite ownership and architecture, concurrency
  acceptance fixtures, and maintenance/architecture documentation.

Validation: typecheck and lint pass. Alternating baseline (edf019aa) vs
candidate runs show no regression on single-session, C01, C02, C04 and a
5-minute C06; Main p99 drops from ~21 ms to ~16.7 ms under concurrency.
Fresh portable copy (1.75M events) upgrade content unchanged; real-model
output paging passes with 4 external requests. Full npm test runs had
1-9 different timing-sensitive failures per run that pass when rerun.
Not covered: C03 review publication, C07 source body, app-level C05.

src/main/agent/native-client-coordinator.ts

@@ -4,7 +4,7 @@ import { mkdir, stat } from 'node:fs/promises'
 import { join } from 'node:path'
 import { promisify } from 'node:util'
 import type { RuntimeNativeClientResult } from '../../shared/runtime-native-client-contracts'
-import type { AssistantDatabase } from '../assistant/assistant-database'
+import type { AssistantStoragePort } from '../assistant-storage-port'
 import type { ApplicationSettingsStore } from '../application-settings-store'
 import type { CapabilityService } from '../capabilities/capability-service'
 import type { ExecutionSpaceResolver } from '../execution-space/execution-space-resolver'
@@ -13,12 +13,12 @@ import type { RuntimeSettingsStore } from '../runtime-settings-store'
 import type { TerminalSessionManager } from '../terminal/terminal-session-manager'
 import type { BundledRuntimePaths } from './bundled-runtimes'
 import type { KnowledgeMcpGateway } from './knowledge-mcp-gateway'
-import { NativeDshWebClientService } from './native-dsh-web-client'
+import { NativeDshWebClientService, type NativeDshWebClientOptions } from './native-dsh-web-client'
 import { NativeTerminalClient } from './native-terminal-client'
 import { applyRuntimeSelection, resolveLayeredRuntimeSelection } from './runtime-selection'
 
 type Options = {
-  database: AssistantDatabase
+  database: Pick<AssistantStoragePort, 'getConversation' | 'getProject'>
   settingsStore: RuntimeSettingsStore
   applicationSettingsStore: ApplicationSettingsStore
   capabilities: CapabilityService
@@ -27,8 +27,10 @@ type Options = {
   localEnvironment: Pick<LocalToolEnvironmentService, 'launchEnvironmentProvider' | 'whenReady'>
   bundledRuntimePaths: BundledRuntimePaths
   rootDirectory: string
+  temporaryRoot?: string
   managedNodeDirectory: string
   npmCliPath: string
+  openModelCallLedger: NativeDshWebClientOptions['openModelCallLedger']
   resourcesPath?: string
   createGateway: () => KnowledgeMcpGateway
   openExternal: (url: string) => Promise<void>
@@ -45,7 +47,9 @@ export class NativeClientCoordinator {
   constructor(private readonly options: Options) {
     this.browser = new NativeDshWebClientService({
       rootDirectory: join(options.rootDirectory, 'dsh'),
+      temporaryRoot: options.temporaryRoot,
       resourcesPath: options.resourcesPath,
+      openModelCallLedger: options.openModelCallLedger,
       resolveLaunchEnvironment: async () => ({
         nodeExecutablePath: await this.prepareNode(),
         environment: options.localEnvironment.launchEnvironmentProvider()
@@ -80,9 +84,9 @@ export class NativeClientCoordinator {
   }
 
   private async resolve(conversationId: string) {
-    const conversation = this.options.database.getConversation(conversationId)
+    const conversation = await this.options.database.getConversation(conversationId)
     if (!conversation.projectId) throw new Error('Native clients require a saved project conversation')
-    const project = this.options.database.getProject(conversation.projectId)
+    const project = await this.options.database.getProject(conversation.projectId)
     const settings = await this.options.settingsStore.getResolvedSettings()
     const selected = applyRuntimeSelection(settings, resolveLayeredRuntimeSelection(
       settings,
@@ -184,6 +188,8 @@ export class NativeClientCoordinator {
       const nodeExecutable = selected.target === 'continue' ? await this.prepareNode() : undefined
       this.assertOwner(ownerId)
       const terminal = await new NativeTerminalClient({
+        temporaryRoot: this.options.temporaryRoot,
+        openModelCallLedger: this.options.openModelCallLedger,
         rootDirectory: join(this.options.rootDirectory, 'terminal'), bundledRuntimePaths: this.options.bundledRuntimePaths,
         nodeExecutable, launchEnvironmentProvider: this.options.localEnvironment.launchEnvironmentProvider,
         terminalManager: { create: async (owner, input, launch) => {