feat(frank-zealot): apply the refusal-direction adapter at load

Frank ordered the adapter; this adds it to the shape as one knob and one flag.

- `LORA_FILE` / `LORA_SCALE` in the env, `--lora-scaled <file>:<scale>` as ONE
  argv token so a scale can never reach the engine without its adapter. The
  rollback follows the mmproj convention exactly: `LORA_FILE=` (explicitly
  empty) drops the flag entirely, no rebuild, and `LORA_SCALE=0` is the card's
  own "inert but present" value.
- New fetcher `scripts/download-frank-zealot-uncensored-lora.sh`: `-f`, byte
  count, sha256, `--verify-only`, idempotent. The file is NOT LFS (a plain git
  object), so the pinned sha is the content hash, not an LFS oid.
- The deployer gates on the adapter beside the pack and the projector, and its
  error names the ADAPTER's fetcher — sending an operator to the bonsai9 script
  for a 3 MB file is how a payload ships without it.
- Seam: path+scale pinned as one token, the scale knob including 0, absence on
  the empty opt-out, a refusal to boot on a missing adapter, and the env ↔
  deployer anti-drift pair extended to LORA_FILE/LLM_ZEALOT_LORA. 454/454.

Provenance, stated where it will be read: the adapter's own metadata names
`Ternary-Bonsai-2-9B-PTQ1_0.gguf` (3561df7a…) as the pack the direction was
fitted against. This endpoint serves the PQ2_0+MTP+Q8_0 packing (c79fcdfa…),
which is not that file and is not on this host. The loader matches tensor names,
not hashes, so it applies — and build 10777 is the build the card verified on —
but the strength is calibrated on a sibling quantization. The proof is therefore
the refusal probe against the live endpoint, captured before and after, and not
the card's table.

tests/frank_zealot_unit.bats

@@ -12,7 +12,10 @@
 # pool (4,096 B/position, 2,352.00 MiB here), and the 786,432 pool this shape
 # replaced cannot carry a drafter at any dtype inside the 24,123 MiB the driver
 # leaves addressable. The publisher's own Q8_0 vision projector rides along (the
-# BF16 one can crash on concurrent images). Log
+# BF16 one can crash on concurrent images). The payload also carries a
+# REFUSAL-DIRECTION ADAPTER: a rank-1 LoRA applied at load, so the seam pins the
+# --lora-scaled token (path and scale together), the scale knob, and the
+# empty-LORA_FILE opt-out.
 # This seam runs the serve script against a stub engine and asserts on the
 # argv it actually execs, so what is pinned is the command the operator gets.
 
@@ -39,8 +42,9 @@ STUB
     # (the env) instead of silently forking the test's filename constants.
     MODEL_STUB="$(basename "$(sed -nE 's/^MODEL_FILE=(.+)$/\1/p' "$ENV_FILE")")"
     MM_STUB="$(basename "$(sed -nE 's/^MMPROJ_FILE=(.+)$/\1/p' "$ENV_FILE")")"
+    LORA_STUB="$(basename "$(sed -nE 's/^LORA_FILE=(.+)$/\1/p' "$ENV_FILE")")"
     DRAFT_STUB="draft-assistant.gguf"
-    touch "$MODEL_DIR/$MODEL_STUB" "$MODEL_DIR/$MM_STUB" "$MODEL_DIR/$DRAFT_STUB"
+    touch "$MODEL_DIR/$MODEL_STUB" "$MODEL_DIR/$MM_STUB" "$MODEL_DIR/$LORA_STUB" "$MODEL_DIR/$DRAFT_STUB"
 }
 
 teardown() {
@@ -69,6 +73,8 @@ SPEC_DRAFT_N_MAX=$(sed -nE 's/^SPEC_DRAFT_N_MAX=([0-9]+)$/\1/p' "$ENV_FILE")
 VERBOSITY=$(sed -nE 's/^VERBOSITY=([0-9]+)$/\1/p' "$ENV_FILE")
 METRICS=$(sed -nE 's/^METRICS=([0-9]+)$/\1/p' "$ENV_FILE")
 NGL=$(sed -nE 's/^NGL=([0-9]+)$/\1/p' "$ENV_FILE")
+LORA_FILE=$MODEL_DIR/$LORA_STUB
+LORA_SCALE=$(sed -nE 's/^LORA_SCALE=(.+)$/\1/p' "$ENV_FILE")
 EOF
     run env FRANK_ZEALOT_ENV_FILE="$envf" nvidia-modprobe=true bash "$SERVE"
 }
@@ -117,7 +123,7 @@ run_stage() {
     grep -q 'FRANK_ZEALOT_ENV_FILE=/home/dank/serverAppConfigs/scripts/frank-zealot.env' "$UNIT"
 }
 
-@test "the shipped env points at the fork runtime and the Bonsai-2 9B MTP pair" {
+@test "the shipped env points at the fork runtime, the MTP pair and the refusal adapter" {
     # The payload path IS the endpoint's identity, and the runtime is part of
     # it here: the file's custom tensor type 142 + prism.hadamard.* metadata
     # make the PrismML build the only loader, and this build must be >= b10776
@@ -127,6 +133,7 @@ run_stage() {
     grep -qE '^LLAMA_BIN=/home/dank/GitPackages/llama-prism-b10777/llama-server$' "$ENV_FILE"
     grep -qE '^MODEL_FILE=/home/dank/models/Bonsai2-9B-MTP/Ternary-Bonsai-2-9B-PQ2_0-MTP-Q8_0\.gguf$' "$ENV_FILE"
     grep -qE '^MMPROJ_FILE=/home/dank/models/Bonsai2-9B-MTP/Ternary-Bonsai-2-9B-mmproj-Q8_0\.gguf$' "$ENV_FILE"
+    grep -qE '^LORA_FILE=/home/dank/models/Bonsai2-9B-MTP/Ternary-Bonsai-2-9B-Uncensored-LoRA\.gguf$' "$ENV_FILE"
 }
 
 @test "the deployer gates on exactly the payload paths the env file ships" {
@@ -135,7 +142,7 @@ run_stage() {
     # would be gating on a file nobody reads — and a missing projector would
     # ship a blind endpoint.
     local env_v dep_v path pair
-    for pair in "MODEL_FILE LLM_ZEALOT_MODEL_FILE" "MMPROJ_FILE LLM_ZEALOT_MMPROJ"; do
+    for pair in "MODEL_FILE LLM_ZEALOT_MODEL_FILE" "MMPROJ_FILE LLM_ZEALOT_MMPROJ" "LORA_FILE LLM_ZEALOT_LORA"; do
         env_v="${pair%% *}"
         dep_v="${pair##* }"
         path="$(sed -nE "s/^${env_v}=(.+)$/\1/p" "$ENV_FILE")"
@@ -367,6 +374,45 @@ run_stage() {
     ! grep -qxF -- '--mmproj' <<<"$output"
 }
 
+@test "the refusal adapter reaches the engine as path and scale in ONE token" {
+    # --lora-scaled takes FNAME:SCALE as a single argument, so the seam pins the
+    # whole token. An adapter that reaches the engine without its scale — or a
+    # scale without its adapter — is a different payload than the one the env
+    # file describes, and nothing else would notice.
+    serve_argv
+    [ "$status" -eq 0 ]
+    local scale
+    scale="$(sed -nE 's/^LORA_SCALE=(.+)$/\1/p' "$ENV_FILE")"
+    [ "$(argv_value --lora-scaled)" = "$MODEL_DIR/$LORA_STUB:$scale" ]
+}
+
+@test "the scale knob rides inside the token, including the card's off value" {
+    # Distinctive values first: proof the flag is wired to the env and not
+    # merely to the script's default. Scale 0 is the card's second mode — the
+    # direction present but inert — so the endpoint can be neutered without
+    # deleting a file or rebuilding anything.
+    serve_argv
+    { echo 'LORA_SCALE=0'; } >> "$STAGE/test.env"
+    run_stage
+    [ "$status" -eq 0 ]
+    [ "$(argv_value --lora-scaled)" = "$MODEL_DIR/$LORA_STUB:0" ]
+
+    sed -i 's|^LORA_SCALE=.*|LORA_SCALE=0.75|' "$STAGE/test.env"
+    run_stage
+    [ "$status" -eq 0 ]
+    [ "$(argv_value --lora-scaled)" = "$MODEL_DIR/$LORA_STUB:0.75" ]
+}
+
+@test "LORA_FILE empty opts the adapter out and leaves no trace in the argv" {
+    # The rollback is ABSENCE of the flag: an empty argument would have the
+    # engine open "" and die at load, which is the failure this seam forbids.
+    serve_argv
+    sed -i 's|^LORA_FILE=.*|LORA_FILE=|' "$STAGE/test.env"
+    run_stage
+    [ "$status" -eq 0 ]
+    ! grep -qxF -- '--lora-scaled' <<<"$output"
+}
+
 @test "the card sampler's only non-metadata term reaches the argv" {
     # general.sampling.* (temperature / top_p / top_k / min_p / repeat_penalty)
     # rides in the checkpoint and the engine reads it itself; presence penalty
@@ -406,23 +452,33 @@ run_stage() {
     grep -qxF -- '--jinja' <<<"$output"
 }
 
-@test "the serve script refuses a missing runtime, GGUF or projector" {
+@test "the serve script refuses a missing runtime, GGUF, projector or adapter" {
     rm -f "$MODEL_DIR/$MM_STUB"
     serve_argv
     [ "$status" -ne 0 ]
     [[ "$output" == *"frank-zealot: missing"* ]]
 
+    # The adapter is payload: a fetch that stopped short must not boot a
+    # silently-plain endpoint, and Restart=always would loop on the missing
+    # file until somebody reads the name in the log.
+    touch "$MODEL_DIR/$MM_STUB"
+    rm -f "$MODEL_DIR/$LORA_STUB"
+    serve_argv
+    [ "$status" -ne 0 ]
+    [[ "$output" == *"frank-zealot: missing $MODEL_DIR/$LORA_STUB"* ]]
+
     rm -f "$RUNTIME_DIR/bin/llama-server"
     serve_argv
     [ "$status" -ne 0 ]
     [[ "$output" == *"frank-zealot: missing"* ]]
 }
 
-@test "the deploy handler gates on binary, GGUF and projector, then MainPID-hardens health" {
+@test "the deploy handler gates on binary, GGUF, projector and adapter, then MainPID-hardens health" {
     grep -q 'deploy_llm_zealot' "$REMOTE_DEPLOY"
     grep -q 'LLM_ZEALOT_RUNTIME' "$REMOTE_DEPLOY"
     grep -q 'LLM_ZEALOT_MODEL_FILE' "$REMOTE_DEPLOY"
     grep -q 'LLM_ZEALOT_MMPROJ' "$REMOTE_DEPLOY"
+    grep -q 'LLM_ZEALOT_LORA' "$REMOTE_DEPLOY"
     grep -q 'relink_unit frank-zealot' "$REMOTE_DEPLOY"
     grep -q 'systemctl enable frank-zealot.service' "$REMOTE_DEPLOY"
     grep -q '127.0.0.1:7771/health' "$REMOTE_DEPLOY"