storage: unify operational SQLite ownership

[likun666661]

Part of #1649. Implements the second migration stage after #1655.

What

• adds one process-local operational database owner for runtime.sqlite, including shared connection lifetime and transaction boundaries for RuntimeEvent, Session metadata, and Agent Graph repositories
• adds an operational schema registry and durable cutover_journal
• moves the canonical Session metadata and Agent Graph tables from sessions.sqlite into runtime.sqlite
• keeps Session transcript bodies as append-only JSONL and keeps the legacy database as read-only migration evidence
• updates bundle, backup, maintenance, and usage readers to use the unified database path

Cutover protocol

On first operational open, the owner:

1. migrates the runtime, Session metadata, and operational schemas
2. locks and fingerprints the complete logical contents of sessions.sqlite
3. records a durable started journal entry
4. copies all Session and Agent Graph tables in one SQLite transaction
5. validates every source row and records per-table counts
6. atomically marks the cutover completed

A retry with the same source is a no-op. A changed legacy source after started or completed fails closed. Conflicting target rows fail closed without overwriting canonical data.

Verification

• Storage full suite: 818 passed, 1 skipped
• CLI full suite: 689 passed
• Runtime Host full suite: passed
• targeted operational cutover tests cover shared ownership, schema registry, idempotent reopen, conflicting rows, empty source rejection, changed-source rejection, and failpoints after started, copy, and validation
• Runtime full suite reached 2823 tests with one existing macOS sandbox argv environment failure
• Headless full suite reached 1433 tests with two existing Python 3.9 Harbor adapter failures
• relevant workspace typechecks and Biome lint pass

The unrelated UI/Desktop typecheck baseline is currently blocked locally by the Astryx package/export mismatch already present on main.