Prove every ext-state write by reading the key back, so no guard is constant-true

SetProjExtState's return describes the whole extname. The persist and the instrument's publish now re-read their key; both refusals can finally fire.

src/shell/instrument/reaper_bridge.h

@@ -47,10 +47,16 @@ public:
     // The instrument's TWO sanctioned ext-state write surfaces, each accepting exactly one
     // key prefix and refusing every other key. That structural refusal is what keeps the
     // read-only-BANK invariant intact — banks/view/tail/assign stay unwritable from here —
-    // and neither payload is bank state. Both return true iff the write landed (the
-    // SetProjExtState return is checked) and neither is RT-safe: the call sites are the
+    // and neither payload is bank state. Neither is RT-safe: the call sites are the
     // off-audio-thread reload path and the editor's UI tick.
     //
+    // Both return true iff the key READ BACK as exactly the value written (an empty value
+    // is a clear, which lands as an absent-or-empty key). SetProjExtState's own return
+    // cannot answer that — wire::extStateWriteLanded owns why, and testing it here was a
+    // guard that could never fire. A `false` does not distinguish a write that was never
+    // issued (unconnected host, refused prefix) from one that did not take or could not be
+    // checked; a caller must not name one of the three.
+    //
     // Neither marks the project dirty. A usage change always rides a component-state change
     // that already does; a bake request is transient and is cleared in the same tick.