comfyui: use keep-groups instead of a named render group

Rootless podman cannot resolve the literal group name 'render' inside the
container user namespace and fails the start with 'unable to find group
render'. keep-groups preserves the launching user's real supplementary
groups (dank is in render on this host), which is the canonical rootless
ROCm device-access recipe.

dankclaw/compose.yaml

@@ -30,9 +30,11 @@ services:
     devices:
       - /dev/kfd:/dev/kfd
       - /dev/dri:/dev/dri
+    # keep-groups preserves the launching user's real supplementary groups;
+    # a literal `render` entry fails at container start under rootless podman
+    # because the group name cannot be resolved inside the user namespace.
     group_add:
-      - video
+      - keep-groups
-      - render
     volumes:
       - /home/dank/comfyui-data/models:/opt/ComfyUI/models
       - /home/dank/comfyui-data/input:/opt/ComfyUI/input