feat(storage): move desktop SQLite ownership into a storage utility process

Main no longer opens desktop business SQLite. A single utility-process
storage owner holds the Assistant, Knowledge, attachment, document-result,
remote-binding and native model-ledger databases and runs whole domain
transactions; Main and Runtime callers use explicit async domain operations.

- Remove the Main readWithFallback path and the supervision worker's
  separate business write connection; manifests are scanned read-only and
  committed by the sole writer.
- Remote events are ACKed only after commit; process loss reports
  unconfirmed writes instead of replaying them.
- Use native utilityProcess messaging with one in-flight bound (32) and
  ordered waiting instead of capacity rejection and retries.
- Start the storage process before the window so startup overlaps.
- Keep short tool output in memory and store full output once in owned
  storage; paging, branching, restart and deletion reuse that copy.
- Put required runtime launch files under goodbuddy-prefixed owned temp
  directories and reclaim confirmed stale ones; stop writing duplicate
  parsed.md.
- Add lint guards for SQLite ownership and architecture, concurrency
  acceptance fixtures, and maintenance/architecture documentation.

Validation: typecheck and lint pass. Alternating baseline (edf019aa) vs
candidate runs show no regression on single-session, C01, C02, C04 and a
5-minute C06; Main p99 drops from ~21 ms to ~16.7 ms under concurrency.
Fresh portable copy (1.75M events) upgrade content unchanged; real-model
output paging passes with 4 external requests. Full npm test runs had
1-9 different timing-sensitive failures per run that pass when rerun.
Not covered: C03 review publication, C07 source body, app-level C05.

src/shared/conversation-output.ts

@@ -0,0 +1,41 @@
+import { z } from 'zod'
+import type { ConversationMessage } from './assistant-contracts'
+
+export const conversationOutputReadSchema = z.object({
+  conversationId: z.string().uuid(),
+  handle: z.string().regex(/^(?:process|rg|subagent):[0-9a-f-]{36}$/iu),
+  cursor: z.number().int().nonnegative().default(0),
+  limitBytes: z.number().int().min(1).max(32768).default(32768)
+}).strict()
+
+export type ConversationOutputPage = {
+  content: string
+  cursor: number
+  nextCursor: number
+  totalBytes: number
+  eof: boolean
+}
+
+export function conversationMessageResourceIds(message: ConversationMessage): string[] {
+  const ids = new Set(message.attachments?.map(attachment => attachment.resourceId ?? attachment.id))
+  for (const handle of conversationMessageOutputHandles(message)) ids.add(handle.slice(handle.lastIndexOf(':') + 1))
+  return [...ids]
+}
+
+export function conversationMessageOutputHandles(message: ConversationMessage): string[] {
+  const handles = new Set<string>()
+  const add = (handle: string): void => {
+    if (/^(?:process|rg|subagent):[0-9a-f-]{36}$/iu.test(handle)) handles.add(handle)
+  }
+  for (const tool of message.tools ?? []) for (const reference of tool.outputReferences ?? []) add(reference.handle)
+  for (const block of message.blocks ?? []) {
+    if (block.type === 'tool') for (const reference of block.tool.outputReferences ?? []) add(reference.handle)
+  }
+  for (const subagent of message.subagents ?? []) {
+    if (subagent.outputReference) add(subagent.outputReference.handle)
+    for (const block of subagent.progress ?? []) {
+      if (block.type === 'tool') for (const reference of block.tool.outputReferences ?? []) add(reference.handle)
+    }
+  }
+  return [...handles]
+}