feat(storage): move desktop SQLite ownership into a storage utility process

Main no longer opens desktop business SQLite. A single utility-process
storage owner holds the Assistant, Knowledge, attachment, document-result,
remote-binding and native model-ledger databases and runs whole domain
transactions; Main and Runtime callers use explicit async domain operations.

- Remove the Main readWithFallback path and the supervision worker's
  separate business write connection; manifests are scanned read-only and
  committed by the sole writer.
- Remote events are ACKed only after commit; process loss reports
  unconfirmed writes instead of replaying them.
- Use native utilityProcess messaging with one in-flight bound (32) and
  ordered waiting instead of capacity rejection and retries.
- Start the storage process before the window so startup overlaps.
- Keep short tool output in memory and store full output once in owned
  storage; paging, branching, restart and deletion reuse that copy.
- Put required runtime launch files under goodbuddy-prefixed owned temp
  directories and reclaim confirmed stale ones; stop writing duplicate
  parsed.md.
- Add lint guards for SQLite ownership and architecture, concurrency
  acceptance fixtures, and maintenance/architecture documentation.

Validation: typecheck and lint pass. Alternating baseline (edf019aa) vs
candidate runs show no regression on single-session, C01, C02, C04 and a
5-minute C06; Main p99 drops from ~21 ms to ~16.7 ms under concurrency.
Fresh portable copy (1.75M events) upgrade content unchanged; real-model
output paging passes with 4 external requests. Full npm test runs had
1-9 different timing-sensitive failures per run that pass when rerun.
Not covered: C03 review publication, C07 source body, app-level C05.

src/main/agent/native-terminal-client.e2e.test.ts

@@ -10,6 +10,7 @@ import type { NativeTerminalLaunch } from '../terminal/terminal-session-manager'
 import { LocalTerminalSession } from '../terminal/local-terminal-session'
 import { resolveBundledRuntimePaths } from './bundled-runtimes'
 import { NativeTerminalClient } from './native-terminal-client'
+import { AgentModelCallLedger } from '../../agent-daemon/agent-model-gateway'
 
 // Opt-in because these tests execute the installed native clients and a real PTY.
 describe.skipIf(!process.env.GOODBUDDY_NATIVE_NODE)('installed native terminal clients', () => {
@@ -21,6 +22,7 @@ describe.skipIf(!process.env.GOODBUDDY_NATIVE_NODE)('installed native terminal c
       const requests: Array<Record<string, unknown>> = []
       const profile = { id: 'native-test', name: 'Native Test Model', modelName: 'native-test-model', baseUrl: 'https://native-test.invalid/v1', protocol: 'openai-chat-completions' as const, authentication: 'api-key' as const, apiKey: 'test-provider-secret' }
       const client = new NativeTerminalClient({
+        openModelCallLedger: async path => new AgentModelCallLedger(path),
         rootDirectory: root,
         nodeExecutable: process.env.GOODBUDDY_NATIVE_NODE,
         bundledRuntimePaths: resolveBundledRuntimePaths({ appPath: process.cwd(), resourcesPath: '', packaged: false }),