Make the background agent the single durable Library writer

[IMONsergey]

Final state

Merged production single-writer Library architecture.

Process ownership

• background ParakeyApp agent is the only durable library/index.json writer;
• visible NativeProductWindowController is strictly read-only;
• UI reads atomic Library snapshots and combines them with volatile runtime state through SuperDictateLibraryReconciler;
• a just-finished live recording may appear immediately in the presentation projection before the agent disk write lands, but the UI never persists that projection.

Agent persistence hooks

• existing enabled legacy history is migrated at agent startup;
• every successful addToHistory schedules an idempotent durable merge;
• History = Off always schedules a durable clear, even when the in-memory recent cache is already empty;
• visible product state hides recordings/tasks/evidence immediately while history is Off instead of waiting for the asynchronous file clear.

Race safety

• migration is add-only and never overwrites richer durable metadata/evidence;
• persistence commands have monotonic revisions;
• one actor serializes/coalesces writes;
• stale operations re-check revision after awaited reads and cannot undo a newer privacy clear;
• bounded recent-history absence is not treated as durable deletion.

Permanent repository invariant

scripts/check.sh fails if the visible product controller calls Library write APIs or if required startup/success/History-Off agent hooks disappear.

Validation

Final ordinary read-only-workflow head passed repository checks, unchanged Parakey self-tests, complete SuperDictateCoreTests, release .app build, strict codesign verification and real install/uninstall smoke.

No audio capture, ASR inference, AVAudioConverter, insertion, hotkey or TCC behavior was rewritten.