Narrow the mode switch's persist to the one key it changes

A switch wrote all seven ext-state keys to record that view_state moved,
re-serializing the bank book and the tracking ledger for nothing. Both entry
surfaces now take saveViewStateOnly; every other caller keeps the full save.

src/shell/persist/session.h

@@ -131,6 +131,19 @@ public:
     // remove the Ctrl-Z for a bank mutation that landed.
     bool saveToActiveProject();
 
+    // The narrowed sibling, for a caller that changed ONLY the Design-View model:
+    // writes `view_state`, marks the project dirty, and touches no other key. The
+    // full save stays the default — this is opt-in per call site.
+    //
+    // Opt-in rather than a per-key dirty flag on the session: a call site that
+    // forgets to opt in merely pays the old cost, whereas a mutation site that
+    // forgets to mark its key dirty would silently stop persisting it, and the
+    // dirty flags would have to be threaded through every writer of book_/tail_/
+    // tracking_ across the capture, bank-op and ingest layers.
+    //
+    // Returns on the SAME rule as saveToActiveProject above, prohibition included.
+    bool saveViewStateOnly();
+
     // Report-only prune dry-run: feeds the pure core with (present, referenced,
     // owned) — `present` from the folder enumeration, the other two from the
     // tracking authority. FAIL-SAFE: tracking state the authority cannot read