feat(storage): move desktop SQLite ownership into a storage utility process

Main no longer opens desktop business SQLite. A single utility-process
storage owner holds the Assistant, Knowledge, attachment, document-result,
remote-binding and native model-ledger databases and runs whole domain
transactions; Main and Runtime callers use explicit async domain operations.

- Remove the Main readWithFallback path and the supervision worker's
  separate business write connection; manifests are scanned read-only and
  committed by the sole writer.
- Remote events are ACKed only after commit; process loss reports
  unconfirmed writes instead of replaying them.
- Use native utilityProcess messaging with one in-flight bound (32) and
  ordered waiting instead of capacity rejection and retries.
- Start the storage process before the window so startup overlaps.
- Keep short tool output in memory and store full output once in owned
  storage; paging, branching, restart and deletion reuse that copy.
- Put required runtime launch files under goodbuddy-prefixed owned temp
  directories and reclaim confirmed stale ones; stop writing duplicate
  parsed.md.
- Add lint guards for SQLite ownership and architecture, concurrency
  acceptance fixtures, and maintenance/architecture documentation.

Validation: typecheck and lint pass. Alternating baseline (edf019aa) vs
candidate runs show no regression on single-session, C01, C02, C04 and a
5-minute C06; Main p99 drops from ~21 ms to ~16.7 ms under concurrency.
Fresh portable copy (1.75M events) upgrade content unchanged; real-model
output paging passes with 4 external requests. Full npm test runs had
1-9 different timing-sensitive failures per run that pass when rerun.
Not covered: C03 review publication, C07 source body, app-level C05.

src/main/local-tool-environment/managed-python-install.test.ts

@@ -1,9 +1,11 @@
-import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises'
+import { mkdtemp, mkdir, readdir, readFile, rm, writeFile } from 'node:fs/promises'
+import { randomUUID } from 'node:crypto'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it } from 'vitest'
 import {
   installManagedPython,
+  cleanupManagedPythonOperations,
   removeManagedPython
 } from './managed-python-install'
 
@@ -22,6 +24,22 @@ afterEach(async () => {
 })
 
 describe('Managed Python staged operations', () => {
+  it('reclaims only known abandoned operation layouts inside the owned root', async () => {
+    const rootDirectory = await root()
+    await cleanupManagedPythonOperations(rootDirectory)
+    const retained = ['cache', 'history', 'python-3.13.15', `.managed-python-download-${randomUUID()}`]
+    for (const name of retained) await mkdir(join(rootDirectory, name))
+    await writeFile(join(rootDirectory, '.managed-python-download-unrecognized'), 'keep')
+    await writeFile(join(rootDirectory, `.managed-python-download-${'-'.repeat(36)}`), 'keep')
+    await writeFile(join(rootDirectory, `.managed-python-download-${randomUUID()}`), 'partial archive')
+    await mkdir(join(rootDirectory, `.managed-python-stage-${randomUUID()}`))
+    await mkdir(join(rootDirectory, `.managed-python-backup-${randomUUID()}`))
+    await cleanupManagedPythonOperations(rootDirectory)
+    expect((await readdir(rootDirectory)).sort()).toEqual([
+      '.goodbuddy-managed-python', '.managed-python-download-unrecognized',
+      `.managed-python-download-${'-'.repeat(36)}`, ...retained
+    ].sort())
+  })
   it('publishes only after validation succeeds', async () => {
     const rootDirectory = await root()
     const installed = await installManagedPython({

src/main/local-tool-environment/managed-python-install.ts

@@ -15,6 +15,7 @@ const OWNER_VALUE = 'GoodBuddy managed Python root\n'
 const versionPattern = /^python-(\d+\.\d+\.\d+)$/u
 const stagingPattern = /^\.managed-python-stage-[0-9a-f-]{36}$/u
 const backupPattern = /^\.managed-python-backup-[0-9a-f-]{36}$/u
+const downloadPattern = /^\.managed-python-download-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/u
 
 function ensureNotAborted(signal?: AbortSignal): void {
   if (signal?.aborted) {
@@ -70,9 +71,11 @@ async function ensureOwnedRoot(root: string): Promise<void> {
 export async function cleanupManagedPythonOperations(root: string): Promise<void> {
   await ensureOwnedRoot(root)
   for (const entry of await readdir(root, { withFileTypes: true })) {
+    const operationDirectory =
+      (stagingPattern.test(entry.name) || backupPattern.test(entry.name)) && entry.isDirectory()
+    const partialDownload = downloadPattern.test(entry.name) && entry.isFile()
     if (
-      (stagingPattern.test(entry.name) || backupPattern.test(entry.name)) &&
-      entry.isDirectory() &&
+      (operationDirectory || partialDownload) &&
       !entry.isSymbolicLink()
     ) {
       await rm(child(root, entry.name), { recursive: true, force: true })