feat(storage): move desktop SQLite ownership into a storage utility process

Main no longer opens desktop business SQLite. A single utility-process
storage owner holds the Assistant, Knowledge, attachment, document-result,
remote-binding and native model-ledger databases and runs whole domain
transactions; Main and Runtime callers use explicit async domain operations.

- Remove the Main readWithFallback path and the supervision worker's
  separate business write connection; manifests are scanned read-only and
  committed by the sole writer.
- Remote events are ACKed only after commit; process loss reports
  unconfirmed writes instead of replaying them.
- Use native utilityProcess messaging with one in-flight bound (32) and
  ordered waiting instead of capacity rejection and retries.
- Start the storage process before the window so startup overlaps.
- Keep short tool output in memory and store full output once in owned
  storage; paging, branching, restart and deletion reuse that copy.
- Put required runtime launch files under goodbuddy-prefixed owned temp
  directories and reclaim confirmed stale ones; stop writing duplicate
  parsed.md.
- Add lint guards for SQLite ownership and architecture, concurrency
  acceptance fixtures, and maintenance/architecture documentation.

Validation: typecheck and lint pass. Alternating baseline (edf019aa) vs
candidate runs show no regression on single-session, C01, C02, C04 and a
5-minute C06; Main p99 drops from ~21 ms to ~16.7 ms under concurrency.
Fresh portable copy (1.75M events) upgrade content unchanged; real-model
output paging passes with 4 external requests. Full npm test runs had
1-9 different timing-sensitive failures per run that pass when rerun.
Not covered: C03 review publication, C07 source body, app-level C05.

src/main/assistant-storage-startup.ts

@@ -1,35 +1,28 @@
 import { app, ipcMain, type BrowserWindow } from 'electron'
-import { stat } from 'node:fs/promises'
-import { dirname, join } from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { Worker } from 'node:worker_threads'
 import {
   assistantStorageActionSchema,
   assistantStorageProgressSchema,
   type AssistantStorageProgress
 } from '../shared/assistant-storage-contracts'
 import { ipcChannels } from '../shared/ipc-channels'
+import type { DesktopStorageClient } from './desktop-storage-client'
 import { assertTrustedSender } from './trusted-ipc-sender'
-import { getPendingAssistantStorageUpgrade, type AssistantStorageUpgrade } from './assistant/assistant-storage-upgrade'
 import { loadMainWindow } from './window'
 
 export async function prepareAssistantStorage(
   window: BrowserWindow,
-  databasePath: string,
+  createStorage: (publish: (progress: AssistantStorageProgress) => void) => Pick<DesktopStorageClient, 'ready' | 'retry' | 'close'>,
   signal: AbortSignal
 ): Promise<void> {
-  const file = await stat(databasePath).catch((error: NodeJS.ErrnoException) => {
-    if (error.code === 'ENOENT') return undefined
-    throw error
-  })
-  if (!file) return
-  const upgrade = getPendingAssistantStorageUpgrade(databasePath)
-  if (!upgrade) return
+  if (signal.aborted) return
   let progress: AssistantStorageProgress = {
-    stage: 'upgrading', processed: 0, total: 0, bytesBefore: file.size
+    stage: 'upgrading', processed: 0, total: 0, bytesBefore: 0
   }
   let shown = false
   let retry: (() => void) | undefined
+  let abort!: () => void
+  const aborted = new Promise<void>(resolve => { abort = resolve })
+  signal.addEventListener('abort', abort, { once: true })
   ipcMain.handle(ipcChannels.storageUpgradeProgress, (event) => {
     assertTrustedSender(event, window)
     return progress
@@ -52,70 +45,29 @@ export async function prepareAssistantStorage(
         ? next.processed / next.total : 2)
   }
   try {
+    const storage = createStorage(publish)
+    let readiness = storage.ready
     while (!signal.aborted) {
       try {
-        await runStorageWorker(databasePath, upgrade, signal, publish)
+        await Promise.race([readiness, aborted])
+        if (signal.aborted) break
         return
       } catch (error) {
-        if (signal.aborted) return
+        if (signal.aborted) break
         publish({
           ...progress, stage: 'failed',
           error: error instanceof Error ? error.message : '本地数据升级失败'
         })
-        await new Promise<void>((resolve) => {
-          const finish = (): void => {
-            signal.removeEventListener('abort', finish)
-            retry = undefined
-            resolve()
-          }
-          retry = finish
-          signal.addEventListener('abort', finish, { once: true })
-        })
+        await Promise.race([new Promise<void>(resolve => { retry = resolve }), aborted])
+        retry = undefined
+        if (!signal.aborted) readiness = storage.retry()
       }
     }
+    await storage.close()
   } finally {
+    signal.removeEventListener('abort', abort)
     ipcMain.removeHandler(ipcChannels.storageUpgradeProgress)
     ipcMain.removeHandler(ipcChannels.storageUpgradeAction)
     if (!window.isDestroyed()) window.setProgressBar(-1)
   }
 }
-
-function runStorageWorker(
-  databasePath: string,
-  upgrade: AssistantStorageUpgrade,
-  signal: AbortSignal,
-  publish: (progress: AssistantStorageProgress) => void
-): Promise<void> {
-  const cancellation = new SharedArrayBuffer(4)
-  const cancel = (): void => {
-    Atomics.store(new Int32Array(cancellation), 0, 1)
-  }
-  if (signal.aborted) return Promise.resolve()
-  signal.addEventListener('abort', cancel, { once: true })
-  return new Promise<void>((resolve, reject) => {
-    const worker = new Worker(join(
-      dirname(fileURLToPath(import.meta.url)), 'assistant-storage-worker.js'
-    ), { workerData: { databasePath, cancellation, upgrade } })
-    let failure: Error | undefined
-    let done = false
-    worker.on('message', (message: {
-      progress?: AssistantStorageProgress
-      error?: string
-      cancelled?: boolean
-      done?: boolean
-    }) => {
-      if (message.progress) publish(message.progress)
-      if (message.error && !message.cancelled) failure = new Error(message.error)
-      if (message.done || message.cancelled) done = true
-    })
-    worker.once('error', () => {
-      failure = new Error('无法启动本地数据升级，请重启 GoodBuddy 后重试。')
-    })
-    worker.once('exit', (code) => {
-      signal.removeEventListener('abort', cancel)
-      if (failure) reject(failure)
-      else if (done && code === 0) resolve()
-      else reject(new Error('本地数据升级意外结束，请重试。'))
-    })
-  })
-}