1.32.0 - Give a user more than one role

WordPress core only ever lets a user hold one role at a time. Yoko Core now turns the Role field on the Edit User screen into a multi-select, so a site can give a user more than one role — without installing Members or PublishPress Capabilities, both of which already do this and are deferred to automatically when present. This release also carries several contributor-tooling improvements that had been sitting on develop waiting for real plugin work to ship alongside.

• [NEW FEATURE] Multiple user roles — the Role selector on Users → Edit User becomes a select2 multi-select. Only active when neither Members nor PublishPress Capabilities is installed; the same capability checks WordPress core enforces on its own single-role field still apply, including refusing to let an admin remove their own ability to manage other users' roles.
• [IMPROVEMENT] Every feature now gets a structured code review before its pull request is opened. The ce-code-review skill picks reviewer personas from what the diff actually touches and returns findings with severity and evidence rather than impressions — including a new browser-behavior persona for hand-written client-side JavaScript, added this cycle after one shipped a DOM bug no PHPUnit test or code reading could have caught.
• [BUG FIX] The Docker dev site builds again in a cloud session. Its image fetched apt packages over plain HTTP, which the egress proxy refuses, so the build died at apt-get update before it installed a single package.
• [BUG FIX] The Playground demo boots in a cloud session. Node's fetch ignores the proxy variables every other tool reads, so the CLI's core download went straight at the egress gateway and came back as a refusal body it tried to unzip. The demo runner now tells Node to use the proxy, and the session-start hook probes downloads.w.org, the apex the core zip actually comes from.
• [BUG FIX] npm run lint:js and npm run lint:css finish. With no ignore file in the repo, both linted the composer vendor tree, the webpack output and the 2.3 MB pdf.js bundle. The CSS lint went from never returning to four seconds.
• [IMPROVEMENT] Hand-written client-side JavaScript now has to be run in an actual browser — a live install or a standalone Playwright fixture — before a feature can be reported finished; reading the code is no longer treated as verification. AGENTS.md, the ce-code-review and deployment skills, and the PR template all say so now.
• [IMPROVEMENT] The cloud-session setup notes name the two egress entries that are easy to get subtly wrong — wordpress.org is not covered by a *.wordpress.org wildcard, and an allowlist change does not reach containers until a new session — and record that Composer needs COMPOSER_ALLOW_SUPERUSER=1 as root or it silently skips registering the WordPress coding standards.