udev: world-writable compute nodes for spawn-independent GPU access

The comfyui container is spawned by a systemd user unit whose spawn context
carries no supplementary groups, so render-group access to /dev/kfd and
renderD128 was structurally unreachable (keep-groups preserved an empty set;
named group_add 'render' fails name lookup inside the userns). World-mode on
the compute nodes is the only spawn-context-independent grant; display cards
keep their modes. Apply: install to /etc/udev/rules.d, udevadm control
--reload-rules, then trigger by subsystem to re-apply modes to live nodes.

Also maps dankclaw/udev/* in the focused-test selector (not bats-testable).

scripts/test-changed.sh

@@ -192,6 +192,10 @@ for path in "${CHANGED[@]}"; do
             add_test tests/docs_completeness.bats
             add_test tests/deployment_scoping.bats
             ;;
+        dankclaw/udev/*)
+            # Host-level udev rules are applied by manual sudo install + udevadm
+            # trigger, not dispatched as a service; nothing here is bats-testable.
+            ;;
         .AGENTTRASH/*)
             # Trash moves are not testable; skip.
             ;;