v0.11.3 — settings projected into the view-model

Completes the by-construction model / view-model / two-view split.

Settings values are now projected as set:<key>=<value> actions, so the
machine/agent (headless) view can read and change every setting the human GUI
exposes — the last coupling needed for the two views to be drift-proof for both
actions and settings. A closed action vocabulary, forward/reverse
contract tests, a dispatch assert, and a ratchet guard keep them impossible to
drift by construction.