feat(storage): move desktop SQLite ownership into a storage utility process

Main no longer opens desktop business SQLite. A single utility-process
storage owner holds the Assistant, Knowledge, attachment, document-result,
remote-binding and native model-ledger databases and runs whole domain
transactions; Main and Runtime callers use explicit async domain operations.

- Remove the Main readWithFallback path and the supervision worker's
  separate business write connection; manifests are scanned read-only and
  committed by the sole writer.
- Remote events are ACKed only after commit; process loss reports
  unconfirmed writes instead of replaying them.
- Use native utilityProcess messaging with one in-flight bound (32) and
  ordered waiting instead of capacity rejection and retries.
- Start the storage process before the window so startup overlaps.
- Keep short tool output in memory and store full output once in owned
  storage; paging, branching, restart and deletion reuse that copy.
- Put required runtime launch files under goodbuddy-prefixed owned temp
  directories and reclaim confirmed stale ones; stop writing duplicate
  parsed.md.
- Add lint guards for SQLite ownership and architecture, concurrency
  acceptance fixtures, and maintenance/architecture documentation.

Validation: typecheck and lint pass. Alternating baseline (edf019aa) vs
candidate runs show no regression on single-session, C01, C02, C04 and a
5-minute C06; Main p99 drops from ~21 ms to ~16.7 ms under concurrency.
Fresh portable copy (1.75M events) upgrade content unchanged; real-model
output paging passes with 4 external requests. Full npm test runs had
1-9 different timing-sensitive failures per run that pass when rerun.
Not covered: C03 review publication, C07 source body, app-level C05.

src/main/knowledge/knowledge-embedding-index-repository.test.ts

@@ -0,0 +1,66 @@
+import { expect, it, vi } from 'vitest'
+import { KnowledgeEmbeddingIndexRepository } from './knowledge-embedding-index-repository'
+import type { EmbeddingIndexState } from './types'
+
+function fixture() {
+  const state: EmbeddingIndexState = {
+    documentId: 'document', knowledgeBaseId: 'library', provider: 'provider',
+    model: 'model', contentChecksum: 'checksum', status: 'ready',
+    updatedAt: '2026-10-05T00:00:00.000Z'
+  }
+  const database = {
+    getLastEmbeddingIndexJob: () => null,
+    saveEmbeddingIndexJob: vi.fn(async () => undefined),
+    listEmbeddingIndexDocumentIds: () => ['document'],
+    getEmbeddingIndexDocument: () => ({ id: 'document', items: [] }),
+    beginDocumentEmbeddingReplacement: vi.fn(async () => 'replacement'),
+    appendDocumentEmbeddingBatch: vi.fn(async () => undefined),
+    finishDocumentEmbeddingReplacement: vi.fn(async () => state),
+    discardDocumentEmbeddingReplacement: vi.fn(async () => undefined),
+    recordEmbeddingIndexError: vi.fn(async (): Promise<EmbeddingIndexState> => ({ ...state, status: 'error' }))
+  }
+  return { database, state, repository: new KnowledgeEmbeddingIndexRepository(database, 'library') }
+}
+
+it('does not acknowledge a batch before its asynchronous storage commit', async () => {
+  const { database, repository } = fixture()
+  let commit!: () => void
+  database.appendDocumentEmbeddingBatch.mockImplementation(() => new Promise(resolve => { commit = () => resolve(undefined) }))
+  const settled = vi.fn()
+  const pending = repository.appendDocumentReplacement('replacement', 'document', 'provider', 'model', [
+    { itemId: 'chunk', contentChecksum: 'checksum', vector: [1, 0] }
+  ], new AbortController().signal).then(settled)
+  await Promise.resolve()
+  expect(settled).not.toHaveBeenCalled()
+  expect(database.appendDocumentEmbeddingBatch).toHaveBeenCalledWith('replacement', 'document', 'provider', 'model', [
+    { chunkId: 'chunk', contentChecksum: 'checksum', vector: [1, 0] }
+  ])
+  commit()
+  await pending
+  expect(settled).toHaveBeenCalledOnce()
+})
+
+it('returns an admitted replacement for cleanup even when cancellation arrives with its reply', async () => {
+  const { database, repository } = fixture()
+  const controller = new AbortController()
+  database.beginDocumentEmbeddingReplacement.mockImplementation(async () => {
+    controller.abort()
+    return 'replacement'
+  })
+  await expect(repository.beginDocumentReplacement('document', 'provider', 'model', controller.signal)).resolves.toBe('replacement')
+  await repository.discardDocumentReplacement('replacement')
+  expect(database.discardDocumentEmbeddingReplacement).toHaveBeenCalledWith('replacement')
+})
+
+it('reports a committed finish as success when cancellation arrives too late', async () => {
+  const { database, state, repository } = fixture()
+  const controller = new AbortController()
+  database.finishDocumentEmbeddingReplacement.mockImplementation(async () => { controller.abort(); return state })
+  await expect(repository.finishDocumentReplacement('replacement', 'document', 'provider', 'model', controller.signal)).resolves.toBeUndefined()
+})
+
+it('propagates storage exit failures instead of acknowledging the status write', async () => {
+  const { database, repository } = fixture()
+  database.saveEmbeddingIndexJob.mockRejectedValue(new Error('storage exited'))
+  await expect(repository.saveStatus({ job: null })).rejects.toThrow('storage exited')
+})