feat(player): filter loops by rehearsal role

[seonghobae]

Summary

• Connects the existing Workspace role selector to the rehearsal player's
  section picker.
• A selected player or vocal role now sees only playable sections containing
  that role; switching back to All Roles restores every playable section.
• The full song-form roadmap remains unchanged, and the UI explicitly says
  when a role has no mapped playable section. This filters loop targets only;
  it does not claim role-specific stem playback.

This PR is intentionally stacked on the exact current #1063 head:
e517a9875d9eae13113c56d7b2b433ed9a3a7888.

Verification

• Targeted transport/player/Workspace tests: 52 passed.
• Desktop full suite: 258 passed across 23 files.
• Desktop coverage: statements 469/469, branches 357/357, functions
  105/105, lines 454/454.
• Desktop lint and typecheck pass.
• Full ./scripts/harness/quickcheck.sh passes with the repository-pinned npm
  10.9.9 invocation: docs/security/supply-chain/bootstrap checks, ESLint,
  Ruff, Bandit, mypy, desktop/shared-types tests and coverage, Python
  679 passed, 24 skipped with 100% coverage, and Vite build.

The Python suite still prints the existing child Demucs/torch segmentation
fault traceback during one mocked CLI test; the parent pytest completes and
the harness exits successfully. This PR does not claim to fix that unrelated
runtime noise.

Security Notes

• The role filter uses the existing RoleSwitcher allowlist and reads section
  and role identifiers through own data descriptors before they become loop
  selection authority.
• Malformed or sparse role arrays fail closed by excluding that section; blank
  or absent role filters retain the all-role view.
• No new file, URL, subprocess, IPC, WebView, model, or network boundary is
  introduced. No stem playback claim is added.
• The picker keeps aria-pressed, a role-specific group label, localized
  status copy, visible focus styles, and existing minimum touch targets.

Dependency and supply-chain rationale

• No dependency, lockfile, bundled binary, model artifact, or GitHub workflow
  change.
• The change reuses the existing shared RehearsalRole data and transport
  snapshot helpers; no new abstraction or runtime package is introduced.
• Existing repository supply-chain, security, and cross-platform checks passed
  in the full harness.

Reviewer checklist

• Review the exact stacked base/head relationship.
• Confirm role filtering does not imply stem playback.
• Confirm localized and accessible no-role-section states.
• Confirm hosted required checks, resolved threads, and independent
  approval before merge.

---

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5ce0f6ff-1b98-431b-a32d-7b30c1d9bff3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}