feat(storage): move desktop SQLite ownership into a storage utility process

Main no longer opens desktop business SQLite. A single utility-process
storage owner holds the Assistant, Knowledge, attachment, document-result,
remote-binding and native model-ledger databases and runs whole domain
transactions; Main and Runtime callers use explicit async domain operations.

- Remove the Main readWithFallback path and the supervision worker's
  separate business write connection; manifests are scanned read-only and
  committed by the sole writer.
- Remote events are ACKed only after commit; process loss reports
  unconfirmed writes instead of replaying them.
- Use native utilityProcess messaging with one in-flight bound (32) and
  ordered waiting instead of capacity rejection and retries.
- Start the storage process before the window so startup overlaps.
- Keep short tool output in memory and store full output once in owned
  storage; paging, branching, restart and deletion reuse that copy.
- Put required runtime launch files under goodbuddy-prefixed owned temp
  directories and reclaim confirmed stale ones; stop writing duplicate
  parsed.md.
- Add lint guards for SQLite ownership and architecture, concurrency
  acceptance fixtures, and maintenance/architecture documentation.

Validation: typecheck and lint pass. Alternating baseline (edf019aa) vs
candidate runs show no regression on single-session, C01, C02, C04 and a
5-minute C06; Main p99 drops from ~21 ms to ~16.7 ms under concurrency.
Fresh portable copy (1.75M events) upgrade content unchanged; real-model
output paging passes with 4 external requests. Full npm test runs had
1-9 different timing-sensitive failures per run that pass when rerun.
Not covered: C03 review publication, C07 source body, app-level C05.

tests/support/knowledge-retrieval-evaluation.ts

@@ -15,7 +15,7 @@ import { fileURLToPath } from 'node:url'
 import { defineConfig } from 'vitest/config'
 import { z } from 'zod'
 import { embeddingStorageProvider } from '../../src/main/knowledge/embedding-provider-key'
-import { KnowledgeService } from '../../src/main/knowledge/knowledge-service'
+import { TestKnowledgeService as KnowledgeService } from './knowledge-test-service'
 import { knowledgeRetrievalTerms } from '../../src/main/knowledge/retrieval-text'
 import { isPathInside } from '../../src/main/workspace-file-access'
 import type { EmbeddingProvider } from '../../src/main/knowledge/types'
@@ -488,22 +488,22 @@ async function createSeededService(
     embeddingProvider: provider
   })
   await service.initialize()
-  const library = service.createLibrary({
+  const library = (await service.createLibrary({
     id: 'library-retrieval-eval',
     name: 'Synthetic retrieval evaluation',
     storageMode: 'reference',
     graphEnabled: false
-  })
-  const source = service.database.upsertSource({
+  }))
+  const source = (await service.database.upsertSource({
     id: 'source-retrieval-eval',
     knowledgeBaseId: library.id,
     type: 'file',
     location: 'fixture://synthetic-bilingual-v1',
     displayName: 'Synthetic fixture',
     status: 'ready'
-  })
+  }))
   for (const document of fixture.documents) {
-    service.database.upsertDocument(
+    await service.database.upsertDocument(
       {
         id: document.id,
         knowledgeBaseId: library.id,
@@ -520,7 +520,7 @@ async function createSeededService(
         role: 'standalone' as const
       }))
     )
-    service.database.replaceDocumentEmbeddings(
+    await service.database.replaceDocumentEmbeddings(
       document.id,
       embeddingStorageProvider(provider),
       provider.model,