ComfyUI: rootless-correct GPU group config (video only)

Rootless podman cannot map the 'render' gid (990) into the container
namespace (dank's subgid range is 100000+), so --group-add render fails to
start the container. GPU access actually comes from the /dev/kfd + /dev/dri
passthrough, checked host-side (the run user is already in 'render' on the
host). So add only the 'video' group (which resolves) and drop 'render'.

Update the group test to assert video present and render ABSENT (with the
rootless rationale), per the approved rootless config.

dankclaw/compose.yaml

@@ -13,7 +13,9 @@ services:
 
   # --- AI image generation (ROCm GPU backend, gfx1151) ---------------------
   # Built from Containerfile.comfyui on AMD's gfx1151 torch base. The GPU is
-  # passed through (/dev/kfd, /dev/dri) with the video+render groups; no --cpu.
+  # reached via the /dev/kfd + /dev/dri passthrough (checked host-side; the run
+  # user is already in the render group). Only the 'video' group is added:
+  # rootless podman cannot map the render gid into the container namespace.
   # Models + data persist under /opt/comfyui. See ../docs/Dankclaw/ComfyUI.md.
   comfyui:
     build:
@@ -30,7 +32,6 @@ services:
       - /dev/dri:/dev/dri
     group_add:
       - video
-      - render
     volumes:
       - /opt/comfyui/models:/opt/ComfyUI/models
       - /opt/comfyui/input:/opt/ComfyUI/input

tests/comfyui_rocm.bats

@@ -9,7 +9,8 @@
 #
 # STATUS (2026-08-19): the GPU migration is applied. The compose builds
 # comfyui-rocm:gfx1151 from Containerfile.comfyui (AMD's gfx1151 torch base),
-# passes /dev/kfd + /dev/dri, adds the video+render groups, and drops --cpu.
+# passes /dev/kfd + /dev/dri, adds the video group (render is unmappable in
+# rootless), and drops --cpu.
 # The four compose-wiring tests below are active (un-skipped). See
 # docs/Research/ComfyUI ROCm and Vulkan.md.
 
@@ -63,14 +64,19 @@ print("command OK:", cmd)
 PYEOF
 }
 
-@test "comfyui adds the video and render groups" {
+@test "comfyui adds the video group (render is unmappable in rootless)" {
     python3 - "$REPO_ROOT/dankclaw/compose.yaml" <<'PYEOF'
 import sys, yaml
 with open(sys.argv[1]) as fh:
     data = yaml.safe_load(fh)
 groups = data["services"]["comfyui"].get("group_add", [])
-for g in ("video", "render"):
-    assert g in groups, f"comfyui group_add must include {g}; got: {groups}"
+# 'video' is added (it resolves in the rootless namespace). 'render' (gid 990)
+# is intentionally ABSENT: rootless podman cannot map it into the container
+# namespace (the subgid range is 100000+), so --group-add render fails to start.
+# GPU access comes from the /dev/kfd + /dev/dri passthrough, checked host-side
+# (the run user is already a member of 'render' on the host).
+assert "video" in groups, f"comfyui group_add must include video; got: {groups}"
+assert "render" not in groups, f"comfyui group_add must NOT include render (unmappable in rootless); got: {groups}"
 print("groups OK:", groups)
 PYEOF
 }