Signal viewer: channel_scope — a panel that actually owns its channels

[RaulSimpetru]

Stacked on #18 — channel_scope builds on the widget_id multi-panel work, so this targets
that branch rather than main. Review/merge #18 first.

Closes the known gap #18 called out: initial_channels seeds a selection, it does not restrict
one. A per-electrode-grid panel (Quattrocento IN1…IN5, 64 ch each of a 320-ch stream) was
therefore scoped in appearance only — until the user touched it:

• All enabled every channel in the stream
• [Edit…] listed every grid, not just the panel's
• the count read N/320 rather than N/64

SignalViewer(channel_scope=…) is the hard restriction: the columns a panel may ever show. It
bounds the seed, All/None/Invert, the count, the grid selector, shift-click ranges and rubber-band
drags, and it forms part of the selection cache key so a differently-scoped viewer sharing a
widget_id can't inherit another's selection. None (default) is unrestricted — nothing changes
for a single-panel viewer.

Bugs found while reviewing the plan

Codex reviewed the design and blocked it. Each finding was verified in source before being
accepted; four were real and would otherwise have shipped:

• resolve_enabled returns early on an unchanged key, so enforcing the scope only while
  seeding/restoring would let anything that mutated v.channels in between escape it. It now
  clamps on the fast path too.
• Invert went through reduce_selection's XOR, which preserves out-of-scope members (they
  aren't in the target set). It is now a complement within the scope.
• Shift-click selected a raw numeric range — a sparse scope {0,2,4} shift-clicked 0→4 pulled
  in 1 and 3. The span is filtered through the allowed set.
• An active-key change reset last_clicked but not the armed drag, so a drag spanning a
  stream/scope switch applied a stale snapshot.

Design notes

• Fail closed. An explicit scope matching no valid column renders "no channels in scope"
  rather than falling back to every channel — a silent widening would defeat the point of scoping
  a panel. (normalize_layout's forgiving fallback stays right for malformed stream metadata;
  it's wrong for an explicit caller constraint.)
• resolve_initial keeps its signature and takes a keyword-only scope, so the default policy
  runs inside the scope. Without that, a 256‥319 scope would seed "the first 16 of 320" and
  intersect to the empty set — a dead panel.
• Out-of-scope grid cells are nulled, not dropped, so a rectangular grid keeps its physical
  shape and — since rect_to_channels skips None — drag selection is structurally incapable of
  reaching outside the scope.
• Scoped columns that no grid covers are collected into a trailing "other" grid, so
  everything All can select is also individually toggleable.
• The constructor snapshots the scope: Iterable admits a generator, which per-frame
  resolution would exhaust.
• channel_scope also drives the default selection, so a 64-channel scope opens on its first 16
  unless initial_channels is passed too — the multi-grid example passes both.

Notes

• 705 tests pass (9 new), ruff clean. New coverage: sparse/ordered/duplicate/empty/wholly-invalid
  scopes, the 256‥319 high-offset seed, fast-path clamping, scope-fingerprint cache keys,
  sparse shift-click, nulled-grid drags, partial metadata coverage, generator stability, and a
  channel_scope=None regression guard.
• tests/test_stream_lsl.py::test_stream_reconnect_swaps_buffers_atomically remains flaky under
  full-suite load (LSL multicast contention) and passes in isolation — pre-existing.