feat: Account for model memory and retain worker launch ownership

[buildingjoshbetter]

Local embedding and reranking could start allocations without a shared reservation, worker startup could lose ownership evidence across failures, and Qwen embedding calls retained unused decoder caches. This composition adds shared model memory accounting and launch ownership records, and disables decoder caches in the three Qwen embedding constructors. The original models, precision, padding, reranker and output contract remain unchanged. It also carries the previously tested ingestion, provenance and adapter reliability fixes.

Changes since 40928be:

• Windows ingestion completion files and directories are created private at birth (explicit owner and protected DACL through CreateFileW/CreateDirectoryW). Existing objects are never repaired or adopted. POSIX paths are unchanged.
• A missing Windows drive or share root now fails with unsafe_directory instead of recursing.
• Windows-only test doubles let pure POSIX policy fixtures import on Windows; every original test method and assertion is kept.
• Claude Code 2.1 transcripts write permission-mode, last-prompt, cost-state, atis-latch, queue-operation and attachment records. The coverage parser counted them as malformed, so ingestion completion of every real session stayed unproven and retried. Content-free metadata types are now non-conversation. Only attachments of 12 observed host-context types, and queued prompts already recorded as user turns, are skipped. Unknown attachment types still count as malformed, and unrecorded queued prompts are still captured. Found with a sandboxed real Claude Code 2.1.296 host using synthetic data.

Validation at 001e8f1:

• Installed wheel: 93 Python source files verified; 13 isolated imports resolved to the actual installation.
• Focused suites: 782 tests / 2,336 subtests and 1,327 tests / 1,469 subtests passed.
• Combined suite: 4,501 tests / 5,048 subtests and 53 Bun checks passed, with 19 skips (18 existing plus 1 Windows-only drive-root test) and 3 network cases deselected.
• Separate original gates: 739 native source/inert cases and 276 memory cases passed, plus 344 focused tests / 1,055 subtests. Source and input bytes were stable before and after execution.
• Independent review of every change since 40928be was accepted after two reported defects were fixed.

This remains a draft. The retained batch-32 versus batch-8 embedding comparison still fails its original numerical tolerance. Mask-derived position IDs were tested on MPS and do not change it. Full installed Mac retrieval, positive native-host extraction completion (no LLM provider available in the isolated host), the Linux capped service route activation and a hard Mac physical memory cap remain unqualified. The original 26.24 GB workload is not claimed fixed. Windows behavior is proven only by the hosted Windows checks on this head.

The complete code-only diff excludes README, public documentation, setup and compatibility guides, benchmark methodology and public benchmark results. No merges or releases.