feat(storage): move desktop SQLite ownership into a storage utility process

Main no longer opens desktop business SQLite. A single utility-process
storage owner holds the Assistant, Knowledge, attachment, document-result,
remote-binding and native model-ledger databases and runs whole domain
transactions; Main and Runtime callers use explicit async domain operations.

- Remove the Main readWithFallback path and the supervision worker's
  separate business write connection; manifests are scanned read-only and
  committed by the sole writer.
- Remote events are ACKed only after commit; process loss reports
  unconfirmed writes instead of replaying them.
- Use native utilityProcess messaging with one in-flight bound (32) and
  ordered waiting instead of capacity rejection and retries.
- Start the storage process before the window so startup overlaps.
- Keep short tool output in memory and store full output once in owned
  storage; paging, branching, restart and deletion reuse that copy.
- Put required runtime launch files under goodbuddy-prefixed owned temp
  directories and reclaim confirmed stale ones; stop writing duplicate
  parsed.md.
- Add lint guards for SQLite ownership and architecture, concurrency
  acceptance fixtures, and maintenance/architecture documentation.

Validation: typecheck and lint pass. Alternating baseline (edf019aa) vs
candidate runs show no regression on single-session, C01, C02, C04 and a
5-minute C06; Main p99 drops from ~21 ms to ~16.7 ms under concurrency.
Fresh portable copy (1.75M events) upgrade content unchanged; real-model
output paging passes with 4 external requests. Full npm test runs had
1-9 different timing-sensitive failures per run that pass when rerun.
Not covered: C03 review publication, C07 source body, app-level C05.

src/main/assistant/subagent-service.test.ts

@@ -45,6 +45,41 @@ function database() {
 }
 
 describe('SubagentService', () => {
+  it('waits for asynchronous creation and cancellation persistence during shutdown', async () => {
+    let created!: () => void
+    let saved!: () => void
+    const db = {
+      createTask: vi.fn(() => new Promise<void>(resolve => { created = resolve })),
+      updateTaskStatus: vi.fn(() => new Promise<void>(resolve => { saved = resolve })),
+      appendTaskEvent: vi.fn()
+    }
+    const createRuntime = vi.fn()
+    const service = new SubagentService(createRuntime, db as never)
+    const run = service.run({ parentRequest, expert, routingMode: 'manual', signal: new AbortController().signal, onEvent: vi.fn() })
+    const rejected = expect(run).rejects.toThrow()
+    const closed = vi.fn()
+    const closing = service.dispose().then(closed)
+    await Promise.resolve()
+    expect(closed).not.toHaveBeenCalled()
+    created()
+    await vi.waitFor(() => expect(db.updateTaskStatus).toHaveBeenCalledWith(expect.any(String), 'cancelled', expect.any(String)))
+    expect(createRuntime).not.toHaveBeenCalled()
+    expect(closed).not.toHaveBeenCalled()
+    saved()
+    await rejected
+    await closing
+  })
+
+  it('reports rejected persistence to the caller and shutdown', async () => {
+    const failure = new Error('Task storage unavailable')
+    const db = { ...database(), createTask: async () => { throw failure } }
+    const createRuntime = vi.fn()
+    const service = new SubagentService(createRuntime, db as never)
+    await expect(service.run({ parentRequest, expert, routingMode: 'manual', signal: new AbortController().signal, onEvent: vi.fn() })).rejects.toBe(failure)
+    expect(createRuntime).not.toHaveBeenCalled()
+    await expect(service.dispose()).rejects.toBe(failure)
+  })
+
   it.each(['opencode', 'continue'] as const)('saves SSH expert images through the %s Host adapter, never the Desktop save binding', async provider => {
     // Load the Agent entry dynamically: Main and Agent are separate TS projects.
     const { AgentImageToolMcp } = await import('../../agent-daemon/' + 'image-tool-mcp')
@@ -184,7 +219,7 @@ describe('SubagentService', () => {
       expert,
       routingMode: 'smart',
       signal: new AbortController().signal,
-      onEvent: (event) => events.push(event)
+      onEvent: (event) => { events.push(event) }
     })
 
     expect(result.output).toBe(expertOutput)
@@ -282,7 +317,7 @@ describe('SubagentService', () => {
       expert,
       routingMode: 'manual',
       signal: new AbortController().signal,
-      onEvent: (event) => events.push(event),
+      onEvent: (event) => { events.push(event) },
       authorize
     })).resolves.toMatchObject({ output: '部分结果' })
     expect(receivedAuthorize).toBe(authorize)