ensureMasking

Build the masking loader + instantiate the MaskingBridge. Remap-independent, so the preload thread can run it while the remap download is still going. Idempotent.