Set Public Anonymity Selection

Persist the participant's own privacy pick before the conversation starts.

The pick lands in the conversation's anonymity_level snapshot — the same column stamp_conversation_anonymity would fill at start, so every per-conversation gate downstream honors it without new code paths. The campaign level acts as a floor: combining means a participant can only add protections, never remove one the organizer promised everybody.