MaskEditor bakes paint layer into IMAGE output (not just MASK) — reproducible from multiple node types, symptom varies by hardware acceleration

### Prerequisites

- [x] I am running the latest version of ComfyUI
- [x] I have custom nodes enabled

### What happened?

### What happened?

When using MaskEditor (opened via right-click → "Open in MaskEditor") to paint a mask on an image, the resulting IMAGE output has the painted area baked in as a corrupted/discolored patch, rather than staying as a clean, untouched image with the mask kept separately in the MASK output.

The MASK output itself is correct — it's only the IMAGE output that's affected.

### Isolating the bug

- **Reproduces from multiple node types** (Load Image and Save Image both trigger it identically) → this points to the shared MaskEditor dialog/canvas compositing logic, not anything specific to a single node's implementation.
- **MASK output is correct; only IMAGE is affected** → isolates the bug to the export/flatten step, where the paint layer appears to be getting merged into the image pixel data instead of being kept as a separate channel.
- **Symptom changes depending on hardware acceleration:**
- With GPU acceleration **on**: painted area shows a negative/solarized color effect
- With GPU acceleration **off**: painted area shows as a flat, solid baked-in color
- In both cases, the underlying original image content in that region is lost/corrupted — acceleration only changes the visual artifact, not whether the bug occurs.

This acceleration-dependent behavior suggests two related issues stacked together: a canvas readback/color-space handling difference tied to GPU acceleration, layered on top of a more fundamental flattening bug where the paint layer is composited into the IMAGE data rather than exported separately.

### Files observed in input/clipspace after saving

- `clipspace-paint-*.png` — solid black (paint-only layer)
- `clipspace-mask-*.png` — correct colors, mask intact
- `clipspace-painted-*.png` — corrupted
- `clipspace-painted-masked-*.png` — corrupted, and appears to be the file referenced by the node's IMAGE output after saving

### Environment

- ComfyUI: Version: 0.28.0
- Frontend: Version: 1.47.10
- OS/Browser: Windows 11, Opera browser
- Reproduces with hardware acceleration both on and off (see above for differing symptoms)

### Related issues

May be related to #7781 (washed-out colors after MaskEditor save) and other reports of MaskEditor paint leaking into IMAGE output — but this report isolates the bug to the shared dialog component itself (not FLUX-specific, not node-specific) and documents the acceleration-dependent symptom variation.

### Steps to Reproduce

1. Load any image (tested via both **Load Image** and **Save Image** nodes' upload widgets)
2. Right-click → Open in MaskEditor
3. Paint a mask over part of the image, save
4. Preview the resulting IMAGE output

Result: the painted region appears in the IMAGE output as a solid, incorrectly-coloured patch matching the shape of the mask — not the original underlying image content.

### How is this affecting you?

Feature doesn't work as expected

### ComfyUI Frontend Version

1.47.10

### Browser

Other

### Console Errors

```javascript

```

### Logs

```shell

```

### Additional Context

Start at the shared MaskEditor dialog opened through the Load Image and Save Image upload widgets, then reproduce the issue with hardware acceleration on and off. Trace the export/flatten step and compare clipspace-painted-*.png with clipspace-mask-*.png. Done means the IMAGE output preserves the original image while the MASK output retains the painted mask in both acceleration modes.

Written by the indexing model from the issue text.