feat(storage): move desktop SQLite ownership into a storage utility process

Main no longer opens desktop business SQLite. A single utility-process
storage owner holds the Assistant, Knowledge, attachment, document-result,
remote-binding and native model-ledger databases and runs whole domain
transactions; Main and Runtime callers use explicit async domain operations.

- Remove the Main readWithFallback path and the supervision worker's
  separate business write connection; manifests are scanned read-only and
  committed by the sole writer.
- Remote events are ACKed only after commit; process loss reports
  unconfirmed writes instead of replaying them.
- Use native utilityProcess messaging with one in-flight bound (32) and
  ordered waiting instead of capacity rejection and retries.
- Start the storage process before the window so startup overlaps.
- Keep short tool output in memory and store full output once in owned
  storage; paging, branching, restart and deletion reuse that copy.
- Put required runtime launch files under goodbuddy-prefixed owned temp
  directories and reclaim confirmed stale ones; stop writing duplicate
  parsed.md.
- Add lint guards for SQLite ownership and architecture, concurrency
  acceptance fixtures, and maintenance/architecture documentation.

Validation: typecheck and lint pass. Alternating baseline (edf019aa) vs
candidate runs show no regression on single-session, C01, C02, C04 and a
5-minute C06; Main p99 drops from ~21 ms to ~16.7 ms under concurrency.
Fresh portable copy (1.75M events) upgrade content unchanged; real-model
output paging passes with 4 external requests. Full npm test runs had
1-9 different timing-sensitive failures per run that pass when rerun.
Not covered: C03 review publication, C07 source body, app-level C05.

src/main/remote-event-batcher.ts

@@ -15,7 +15,7 @@ export type RemoteEventBatcherOptions<TEvent> = {
    * Durably stores every entry in ONE transaction and returns one flag per
    * entry: true when it was newly stored, false for an already stored replay.
    */
-  persist(entries: readonly RemoteEventBatchEntry<TEvent>[]): readonly boolean[]
+  persist(entries: readonly RemoteEventBatchEntry<TEvent>[]): readonly boolean[] | Promise<readonly boolean[]>
   /** Called when a timer-driven flush fails (for example to abort the run). */
   onError?(error: unknown): void
   /**
@@ -63,6 +63,7 @@ export class RemoteEventBatcher<TEvent> {
   private pending: PendingEntry<TEvent>[] = []
   private timer: ReturnType<typeof setTimeout> | undefined
   private failure: { error: unknown } | undefined
+  private inFlight: Promise<void> | undefined
 
   constructor(options: RemoteEventBatcherOptions<TEvent>) {
     this.persist = options.persist
@@ -84,31 +85,44 @@ export class RemoteEventBatcher<TEvent> {
     return this.pending.length
   }
 
-  add(
+  async add(
     provenance: RemoteSemanticEventProvenance,
     event: TEvent,
     onCommitted?: RemoteEventCommitted<TEvent>
-  ): void {
+  ): Promise<void> {
+    // One producer awaits admission; a timer may already be committing its batch.
+    while (this.inFlight) await this.inFlight
     this.throwIfFailed()
     this.pending.push({ provenance, event, onCommitted })
     if (this.pending.length >= this.maximumEvents) {
-      this.flush()
+      await this.flush()
       return
     }
     this.scheduleFlush()
   }
 
-  flush(): void {
+  async flush(): Promise<void> {
     this.clearTimer()
+    while (this.inFlight) await this.inFlight
     this.throwIfFailed()
     if (this.pending.length === 0) {
       return
     }
     const entries = this.pending
     this.pending = []
+    const operation = this.commit(entries)
+    this.inFlight = operation
+    try {
+      await operation
+    } finally {
+      if (this.inFlight === operation) this.inFlight = undefined
+    }
+  }
+
+  private async commit(entries: PendingEntry<TEvent>[]): Promise<void> {
     let inserted: readonly boolean[]
     try {
-      inserted = this.persist(
+      inserted = await this.persist(
         entries.map(({ provenance, event }) => ({ provenance, event }))
       )
       if (inserted.length !== entries.length) {
@@ -142,12 +156,7 @@ export class RemoteEventBatcher<TEvent> {
     }
     this.timer = setTimeout(() => {
       this.timer = undefined
-      try {
-        this.flush()
-        this.onTimerFlushed?.()
-      } catch (error) {
-        this.onError?.(error)
-      }
+      void this.flush().then(() => this.onTimerFlushed?.()).catch(error => this.onError?.(error))
     }, this.flushIntervalMs)
     this.timer.unref?.()
   }