Convert shared coordinator state to owner-side intent operations

nostrKeyMapping, sentGeoDeliveryAcks/sentReadReceipts dedupe,
isBatchingPublic, geo subscription lifecycle, and private-chat selection
hand-off now mutate through single intent operations on ChatViewModel,
with backing storage locked down via private(set) so the single-writer
property is compiler-enforced. Context protocols downgrade to read-only
access where reads remain. 8 new contract tests.

Known remaining writers outside the protocols: sentReadReceipts is
passed inout to PrivateChatManager.syncReadReceiptsForSentMessages and
un-marked by ChatTransportEventCoordinator on disconnect.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bitchat/ViewModels/ChatDeliveryCoordinator.swift

@@ -14,8 +14,11 @@ import Foundation
 protocol ChatDeliveryContext: AnyObject {
     var messages: [BitchatMessage] { get set }
     var privateChats: [PeerID: [BitchatMessage]] { get set }
-    var sentReadReceipts: Set<String> { get set }
     var isStartupPhase: Bool { get }
+    /// Drops every recorded read receipt whose message ID is not in `validMessageIDs`.
+    /// Returns the number of receipts removed. (Single mutation path for the
+    /// owner's `sentReadReceipts`; this coordinator never reads the raw set.)
+    func pruneSentReadReceipts(keeping validMessageIDs: Set<String>) -> Int
     /// Signals that message state changed so observers refresh (e.g. `objectWillChange.send()`).
     func notifyUIChanged()
     /// Confirms receipt so the message router stops retaining the message for resend.
@@ -57,10 +60,7 @@ final class ChatDeliveryCoordinator {
             }
         )
 
-        let oldCount = context.sentReadReceipts.count
-        context.sentReadReceipts = context.sentReadReceipts.intersection(validMessageIDs)
-
-        let removedCount = oldCount - context.sentReadReceipts.count
+        let removedCount = context.pruneSentReadReceipts(keeping: validMessageIDs)
         if removedCount > 0 {
             SecureLogger.debug("🧹 Cleaned up \(removedCount) old read receipts", category: .session)
         }