fix(newos4): a mode the user picks now survives a reload (v4.6.164)

Found by the operator actually running /ui-selftest.html on his phone. The report said 6/6 PASS,
and the interesting part was what happened next: pick "easy" from the picker, reload, and you are
back in classic. Two defects stacked on top of each other, neither of which reported anything:

1. `apply()` on an unregistered mode starts a lazy load and returns false. When the mode registers,
   `registerMode()` re-applied it with a hardcoded `persist:false` — so the picker's choice was
   never written to `webx11_ui_mode` at all. The intent ("the user asked for this") was dropped the
   moment the mode file had to be fetched, which is the normal case for all six modes.
2. Even when the mode did persist, `webx11_ui_experimental` was never set — and that key is what the
   in-bundle gate reads before UIShellModule is registered. A stored mode behind a closed gate is a
   preference the product silently ignores.

Fix:
  * `_pendingPersist` carries the caller's intent through the lazy path; `registerMode()` honours it
    instead of hardcoding false, and the load-completion apply already forwarded `o.persist`;
  * `_persistMode(want)` writes the mode AND, for a real (non-classic) mode, sets
    `webx11_ui_experimental='1'`, so the gate opens on the next boot.

Both directions verified live on v4.6.164:
  * user pick (lazy path)  -> webx11_ui_mode=easy + webx11_ui_experimental=1, then
    main.html with NO query boots easy (#easy-actions present, body wx11-ui-easy, picker suppressed);
  * shared link ?ui=chat    -> mode applied for the session, _fromQuery=true, localStorage STILL null
    (a link must not become the recipient's preference — that is the shell's own rule and it survives).

Also: /ui-selftest.html no longer prints a meaningless `heapMB: 9.5`. Chromium pins
performance.memory.usedJSHeapSize at 10,000,000 without --enable-precise-memory-info, which a page
cannot request, so the report now says the heap is not measurable in-page instead of inventing a
number — the same fake-green that was fixed in probe-ui-crash.py.

guard 7/7 rc=0, maintain OK, served core-bundle byte-identical to disk.

0 files changed, 0 insertions, 0 deletions