feat(storage): move desktop SQLite ownership into a storage utility process

Main no longer opens desktop business SQLite. A single utility-process
storage owner holds the Assistant, Knowledge, attachment, document-result,
remote-binding and native model-ledger databases and runs whole domain
transactions; Main and Runtime callers use explicit async domain operations.

- Remove the Main readWithFallback path and the supervision worker's
  separate business write connection; manifests are scanned read-only and
  committed by the sole writer.
- Remote events are ACKed only after commit; process loss reports
  unconfirmed writes instead of replaying them.
- Use native utilityProcess messaging with one in-flight bound (32) and
  ordered waiting instead of capacity rejection and retries.
- Start the storage process before the window so startup overlaps.
- Keep short tool output in memory and store full output once in owned
  storage; paging, branching, restart and deletion reuse that copy.
- Put required runtime launch files under goodbuddy-prefixed owned temp
  directories and reclaim confirmed stale ones; stop writing duplicate
  parsed.md.
- Add lint guards for SQLite ownership and architecture, concurrency
  acceptance fixtures, and maintenance/architecture documentation.

Validation: typecheck and lint pass. Alternating baseline (edf019aa) vs
candidate runs show no regression on single-session, C01, C02, C04 and a
5-minute C06; Main p99 drops from ~21 ms to ~16.7 ms under concurrency.
Fresh portable copy (1.75M events) upgrade content unchanged; real-model
output paging passes with 4 external requests. Full npm test runs had
1-9 different timing-sensitive failures per run that pass when rerun.
Not covered: C03 review publication, C07 source body, app-level C05.

src/main/remote-agent/agent-package-manager.ts

@@ -5,7 +5,7 @@ import {
   verify
 } from 'node:crypto'
 import { constants } from 'node:fs'
-import {
+import fs, {
   lstat,
   mkdir,
   open,
@@ -307,6 +307,9 @@ export class AgentPackageManager {
   async getInventory(
     options: { refresh?: boolean } = {}
   ): Promise<AgentPackageInventory> {
+    for (const directory of this.#pendingRemovals) {
+      await this.#removeWhenUnused(directory).catch(() => undefined)
+    }
     if (options.refresh) {
       this.#installed.clear()
     }
@@ -1074,12 +1077,16 @@ export class AgentPackageManager {
         // Invalid cache entries remain visible as an invalid inventory state.
       }
     }
-    return verified.sort((left, right) =>
+    const [current, ...obsolete] = verified.sort((left, right) =>
       compareSemanticVersions(
         right.verified.descriptor.version,
         left.verified.descriptor.version
       )
-    )[0]
+    )
+    for (const record of obsolete) {
+      await this.#removeWhenUnused(record.directory).catch(() => undefined)
+    }
+    return current
   }
 
   async #installArchive(
@@ -1869,21 +1876,19 @@ export class AgentPackageManager {
         return
       }
       this.#leaseCounts.delete(key)
-      if (this.#pendingRemovals.delete(key)) {
-        void rm(key, {
-          recursive: true,
-          force: true
-        }).catch(() => undefined)
+      if (this.#pendingRemovals.has(key)) {
+        void this.#removeWhenUnused(key).catch(() => undefined)
       }
     }
   }
 
   async #removeWhenUnused(directory: string): Promise<void> {
+    this.#pendingRemovals.add(directory)
     if ((this.#leaseCounts.get(directory) ?? 0) > 0) {
-      this.#pendingRemovals.add(directory)
       return
     }
-    await rm(directory, { recursive: true, force: true })
+    await fs.rm(directory, { recursive: true, force: true })
+    this.#pendingRemovals.delete(directory)
   }
 
   #runExclusive<T>(