ComfyUI: rootless-correct GPU group config (video only)

Rootless podman cannot map the 'render' gid (990) into the container
namespace (dank's subgid range is 100000+), so --group-add render fails to
start the container. GPU access actually comes from the /dev/kfd + /dev/dri
passthrough, checked host-side (the run user is already in 'render' on the
host). So add only the 'video' group (which resolves) and drop 'render'.

Update the group test to assert video present and render ABSENT (with the
rootless rationale), per the approved rootless config.

dankclaw/compose.yaml

@@ -13,7 +13,9 @@ services:
 
   # --- AI image generation (ROCm GPU backend, gfx1151) ---------------------
   # Built from Containerfile.comfyui on AMD's gfx1151 torch base. The GPU is
-  # passed through (/dev/kfd, /dev/dri) with the video+render groups; no --cpu.
+  # reached via the /dev/kfd + /dev/dri passthrough (checked host-side; the run
+  # user is already in the render group). Only the 'video' group is added:
+  # rootless podman cannot map the render gid into the container namespace.
   # Models + data persist under /opt/comfyui. See ../docs/Dankclaw/ComfyUI.md.
   comfyui:
     build:
@@ -30,7 +32,6 @@ services:
       - /dev/dri:/dev/dri
     group_add:
       - video
-      - render
     volumes:
       - /opt/comfyui/models:/opt/ComfyUI/models
       - /opt/comfyui/input:/opt/ComfyUI/input