Let one mask be built from more than one selection, and paint into it

A mask the model draws arrives approximately right — stopping inside a
shoulder, leaking into the hair — and FR-DEV-3's edge controls move the
*whole* boundary, so no value of feather or dilation fixes two errors that
go opposite ways. What fixes them is a second selection joined to the first,
and a layer that held exactly one source had nowhere to put one. The brush
the core has had all along was reachable from no control in the application.

A layer is now an ordered list of parts. Each names a source and how it
joins the mask before it — added to it, or taken out of it — and carries its
own edge treatment, because a model's soft coverage and a stroke painted
where it stopped short do not want the same feather. Invert and opacity stay
on the layer, where the composed shader already reads them.

The sidecar grows `[part]` blocks and nothing else. A layer of one part
writes exactly the bytes it always did; a mask block with no part blocks
after it reads back as one part; and a stroke, a join or a source this build
cannot read costs that part rather than the layer. So every sidecar in every
library still parses to the edit it always was.

On the device the parts fold into the layer's one slice, so eight layers
still cost eight channels: union is a `max` blend and subtraction is the
erase blend the brush already used. A part is drawn into a scratch texture
before it is joined, and that is not incidental — an erase stroke means a
hole in *that part*, not a hole in the mask, and drawn straight onto the
accumulator it would punch through the subject underneath. A layer of one
part skips all of it and takes the path it always took.

In the interface: a part list under the selected layer with a chip saying
which way each joins, Add and Subtract beside it, a Select/Paint/Erase strip
with the brush's size, hardness and flow, and a drag on the photograph that
paints. Pressing Paint on a mask that cannot hold a stroke joins a part that
can, rather than explaining that a subject is not a brush. A whole stroke is
one step in the history.

The edge controls now shape the part that is selected rather than the layer,
which is the one behaviour change to an existing control: with a correction
selected, the feather slider softens the correction and leaves the model's
mask alone.

core/dr-gpu/src/shaders/mask.wgsl

@@ -78,6 +78,22 @@ struct MaskParams {
     // rgb: as-shot white balance. w: non-zero when the source arrived
     // gamma-encoded rather than linear.
     as_shot_wb: vec4<f32>,
+
+    // Whether this part is turned over before it joins the mask.
+    //
+    // Read by `fs_combine` and by nothing else, deliberately. A brush deposits
+    // dabs onto an empty field and has no idea what the rest of the frame is,
+    // so a stroke shader cannot invert anything; doing it where the finished
+    // part is read back is the one place that works for every kind of source.
+    invert: u32,
+    // Three scalars rather than a `vec3<u32>`: a three-component vector is
+    // aligned to sixteen bytes in the uniform address space, so it would sit
+    // at offset 144 and make this struct 160 bytes against the Rust side's
+    // 144 — a mismatch wgpu reports as a binding too small for the shader,
+    // several layers away from the padding that caused it.
+    _pad0: u32,
+    _pad1: u32,
+    _pad2: u32,
 }
 
 @group(0) @binding(0) var<uniform> p: MaskParams;
@@ -597,3 +613,29 @@ fn fs_brush(in: BrushVertex) -> @location(0) vec4<f32> {
 
     return vec4<f32>(clamp(coverage * s.flow, 0.0, 1.0), 0.0, 0.0, 1.0);
 }
+
+// ---------------------------------------------------------------------------
+// Joining one part to the mask so far
+// ---------------------------------------------------------------------------
+//
+// A layer's mask is a fold over its parts, and the set operation is the *blend
+// state* rather than arithmetic here: union is `max(dst, src)`, subtraction is
+// `dst * (1 - src)`. Both are fixed-function, so joining a part costs one
+// full-screen draw and no second texture beyond the one being read.
+//
+// # Why a part is drawn aside first, rather than straight onto the mask
+//
+// Because an erase stroke inside a part means "a hole in *this* part", not "a
+// hole in the mask". Painted straight onto the accumulator it would take away
+// whatever the parts before it had put there — so a correction that tidied its
+// own edge would punch through the subject underneath, and the failure would
+// look like the model's mask had holes in it.
+
+@group(0) @binding(7) var part_mask: texture_2d<f32>;
+
+@fragment
+fn fs_combine(@builtin(position) pos: vec4<f32>) -> @location(0) vec4<f32> {
+    let v = textureLoad(part_mask, vec2<i32>(i32(pos.x), i32(pos.y)), 0).r;
+    let m = select(v, 1.0 - v, p.invert != 0u);
+    return vec4<f32>(clamp(m, 0.0, 1.0), 0.0, 0.0, 1.0);
+}