feat(storage): move desktop SQLite ownership into a storage utility process

Main no longer opens desktop business SQLite. A single utility-process
storage owner holds the Assistant, Knowledge, attachment, document-result,
remote-binding and native model-ledger databases and runs whole domain
transactions; Main and Runtime callers use explicit async domain operations.

- Remove the Main readWithFallback path and the supervision worker's
  separate business write connection; manifests are scanned read-only and
  committed by the sole writer.
- Remote events are ACKed only after commit; process loss reports
  unconfirmed writes instead of replaying them.
- Use native utilityProcess messaging with one in-flight bound (32) and
  ordered waiting instead of capacity rejection and retries.
- Start the storage process before the window so startup overlaps.
- Keep short tool output in memory and store full output once in owned
  storage; paging, branching, restart and deletion reuse that copy.
- Put required runtime launch files under goodbuddy-prefixed owned temp
  directories and reclaim confirmed stale ones; stop writing duplicate
  parsed.md.
- Add lint guards for SQLite ownership and architecture, concurrency
  acceptance fixtures, and maintenance/architecture documentation.

Validation: typecheck and lint pass. Alternating baseline (edf019aa) vs
candidate runs show no regression on single-session, C01, C02, C04 and a
5-minute C06; Main p99 drops from ~21 ms to ~16.7 ms under concurrency.
Fresh portable copy (1.75M events) upgrade content unchanged; real-model
output paging passes with 4 external requests. Full npm test runs had
1-9 different timing-sensitive failures per run that pass when rerun.
Not covered: C03 review publication, C07 source body, app-level C05.

src/main/document-parsing-service.test.ts

@@ -114,6 +114,28 @@ function createService(overrides?: {
 }
 
 describe('DocumentParsingService', () => {
+  it('waits for an unnamed diagnostic to settle before closing shared result access', async () => {
+    const { settingsStore, modelManager } = createService()
+    const close = vi.fn(async () => undefined)
+    const service = new DocumentParsingService(settingsStore as never, modelManager as never, {} as never, { close } as never)
+    let finish!: () => void
+    const pending = new Promise<void>(resolve => { finish = resolve })
+    vi.spyOn(service, 'parse').mockImplementation(async (_name, _bytes, _purpose, signal) => {
+      await pending
+      signal?.throwIfAborted()
+      throw new Error('Diagnostic should have been cancelled')
+    })
+    const diagnostic = service.diagnose('source.pdf', Buffer.from('source'))
+    const rejected = expect(diagnostic).rejects.toThrow()
+    const disposing = service.dispose()
+    expect(close).not.toHaveBeenCalled()
+    finish()
+    await rejected
+    await disposing
+    expect(close).toHaveBeenCalledOnce()
+    await expect(service.diagnose('source.pdf', Buffer.from('source'))).rejects.toThrow('closed')
+  })
+
   it.each(['chat-attachment', 'knowledge-index', 'artifact-import', 'diagnostic'] as const)(
     'recognizes embedded PPTX images for %s',
     async (purpose) => {