feat(storage): move desktop SQLite ownership into a storage utility process

Main no longer opens desktop business SQLite. A single utility-process
storage owner holds the Assistant, Knowledge, attachment, document-result,
remote-binding and native model-ledger databases and runs whole domain
transactions; Main and Runtime callers use explicit async domain operations.

- Remove the Main readWithFallback path and the supervision worker's
  separate business write connection; manifests are scanned read-only and
  committed by the sole writer.
- Remote events are ACKed only after commit; process loss reports
  unconfirmed writes instead of replaying them.
- Use native utilityProcess messaging with one in-flight bound (32) and
  ordered waiting instead of capacity rejection and retries.
- Start the storage process before the window so startup overlaps.
- Keep short tool output in memory and store full output once in owned
  storage; paging, branching, restart and deletion reuse that copy.
- Put required runtime launch files under goodbuddy-prefixed owned temp
  directories and reclaim confirmed stale ones; stop writing duplicate
  parsed.md.
- Add lint guards for SQLite ownership and architecture, concurrency
  acceptance fixtures, and maintenance/architecture documentation.

Validation: typecheck and lint pass. Alternating baseline (edf019aa) vs
candidate runs show no regression on single-session, C01, C02, C04 and a
5-minute C06; Main p99 drops from ~21 ms to ~16.7 ms under concurrency.
Fresh portable copy (1.75M events) upgrade content unchanged; real-model
output paging passes with 4 external requests. Full npm test runs had
1-9 different timing-sensitive failures per run that pass when rerun.
Not covered: C03 review publication, C07 source body, app-level C05.

src/main/remote-agent/remote-environment-preparer.ts

@@ -33,7 +33,6 @@ import type {
   VerifiedRemoteAgentInstallCandidate
 } from './agent-package-manager'
 import type {
-  PendingRemoteEnvironmentOperation,
   RemoteEnvironmentOperationStore
 } from './remote-environment-operation-store'
 import type {
@@ -548,13 +547,7 @@ export class RemoteEnvironmentPreparer implements Preparer {
     ) => void,
     signal: AbortSignal
   ): Promise<void> {
-    let pending: PendingRemoteEnvironmentOperation | undefined
-    try {
-      pending = await this.#operationStore.load(hostId)
-    } catch {
-      await this.#operationStore.remove(hostId)
-      return
-    }
+    const pending = await this.#operationStore.load(hostId)
     if (!pending) {
       return
     }
@@ -570,19 +563,19 @@ export class RemoteEnvironmentPreparer implements Preparer {
       await this.#sshPool.acquireRemotePackageBootstrap(
         target,
         signal
-      ).catch(() => undefined)
+      )
     try {
-      if (!bootstrapLease) {
-        return
-      }
       assertLeaseMatchesTarget(bootstrapLease, target)
-      await bootstrapLease.cleanup(
+      const result = await bootstrapLease.cleanup(
         pending.operationId,
         { signal }
-      ).catch(() => undefined)
-    } finally {
-      bootstrapLease?.release()
+      )
+      if (!result.cleaned && result.reason !== 'operation-unavailable') {
+        throw new Error('Previous remote staging cleanup failed; retry environment preparation')
+      }
       await this.#operationStore.remove(hostId)
+    } finally {
+      bootstrapLease.release()
     }
   }
 }