feat(storage): move desktop SQLite ownership into a storage utility process

Main no longer opens desktop business SQLite. A single utility-process
storage owner holds the Assistant, Knowledge, attachment, document-result,
remote-binding and native model-ledger databases and runs whole domain
transactions; Main and Runtime callers use explicit async domain operations.

- Remove the Main readWithFallback path and the supervision worker's
  separate business write connection; manifests are scanned read-only and
  committed by the sole writer.
- Remote events are ACKed only after commit; process loss reports
  unconfirmed writes instead of replaying them.
- Use native utilityProcess messaging with one in-flight bound (32) and
  ordered waiting instead of capacity rejection and retries.
- Start the storage process before the window so startup overlaps.
- Keep short tool output in memory and store full output once in owned
  storage; paging, branching, restart and deletion reuse that copy.
- Put required runtime launch files under goodbuddy-prefixed owned temp
  directories and reclaim confirmed stale ones; stop writing duplicate
  parsed.md.
- Add lint guards for SQLite ownership and architecture, concurrency
  acceptance fixtures, and maintenance/architecture documentation.

Validation: typecheck and lint pass. Alternating baseline (edf019aa) vs
candidate runs show no regression on single-session, C01, C02, C04 and a
5-minute C06; Main p99 drops from ~21 ms to ~16.7 ms under concurrency.
Fresh portable copy (1.75M events) upgrade content unchanged; real-model
output paging passes with 4 external requests. Full npm test runs had
1-9 different timing-sensitive failures per run that pass when rerun.
Not covered: C03 review publication, C07 source body, app-level C05.

src/main/remote-agent/managed-remote-execution-services.ts

@@ -1,5 +1,4 @@
-import { join } from 'node:path'
-import { SqliteRuntimeSessionBindingStore } from '../agent/runtime-session-binding-store'
+import type { RuntimeSessionBindingStore } from '../agent/runtime-session-binding-store'
 import type { ResolvedModelProfile } from '../runtime-settings-store'
 import type {
   AgentRuntimeSelection,
@@ -27,9 +26,8 @@ import {
 } from './managed-model-bridge'
 import { boundedDiagnostic } from './bounded-diagnostic'
 
-const RUNTIME_BINDING_DATABASE_NAME = 'remote-runtime-bindings.sqlite'
-
 export type ManagedRemoteExecutionServicesOptions = {
+  bindingStore: RuntimeSessionBindingStore
   sshHostStore: SshHostStore
   agentServices: Pick<
     RemoteAgentServices,
@@ -39,7 +37,6 @@ export type ManagedRemoteExecutionServicesOptions = {
     | 'connectionManager'
     | 'controllerState'
   >
-  userDataPath: string
   appPath: string
   resourcesPath: string
   packaged: boolean
@@ -60,7 +57,7 @@ export class ManagedRemoteExecutionServices {
   readonly runtimeInstallationManager: RemoteRuntimeInstallationManager
   readonly runtimeValidator: ManagedRemoteProjectRuntimeValidator
   readonly workspaceAccessFactory: ManagedRemoteWorkspaceAccessFactory
-  readonly bindingStore: SqliteRuntimeSessionBindingStore
+  readonly bindingStore: RuntimeSessionBindingStore
 
   #disposePromise?: Promise<void>
   readonly #readiness: Promise<void>
@@ -138,9 +135,7 @@ export class ManagedRemoteExecutionServices {
         installationManager:
           options.agentServices.installationManager
       })
-    this.bindingStore = new SqliteRuntimeSessionBindingStore(
-      join(options.userDataPath, RUNTIME_BINDING_DATABASE_NAME)
-    )
+    this.bindingStore = options.bindingStore
     this.#readiness = Promise.resolve()
   }
 
@@ -213,7 +208,6 @@ export class ManagedRemoteExecutionServices {
       }
     }
     await settle(() => this.runtimeInstallationManager.dispose())
-    await settle(() => this.bindingStore.dispose())
     if (errors.length > 0) {
       throw new AggregateError(
         errors,