feat(lora-worker): Phase 2 publish-step — copy succeeded LoRA into ComfyUI loras + published_lora_name

On a train reaching succeeded, IN ADDITION to output/{name}.safetensors
(unchanged download source), COPY it into ComfyUI's loras search path at
/storetank/arbo/models/loras/trained/{train_id}/{name}.safetensors and
return published_lora_name (the ComfyUI-relative LoraLoader string) in the
terminal GET /train/{id} payload (arbo Phase 2 auto-registration, §4.1/§7).

- Copy not move; a publish failure NEVER fails the train (keeps succeeded,
  omits published_lora_name, logs the reason to the tailable run log).
- INV-T7-safe: a copy to a fixed computed path, no new free-form args.
- train_id derived from the handoff layout (output_dir.parent.name).
- Provisions loras/trained/ (arbotrain 2775, group-write per the Phase-1
  lesson; world-readable/traversable for ComfyUI) via the deploy playbook.
- ComfyUI verified to resolve nested loras subfolders (no flat fallback).
- Pure path helper unit-tested; 16 tests green.

playbooks/deploy-lora-training-worker.yaml

@@ -15,6 +15,7 @@ vars:
   stage_dir: /tmp/lora-training-worker-stage
   install_dir: /opt/lora-training-worker
   handoff_dir: /worktank/arbo/train
+  loras_publish_dir: /storetank/arbo/models/loras/trained
   worker_user: llmuser
   arbo_user: lkraven          # arbo container runs as uid 1000 = host lkraven
   group: arbotrain
@@ -46,6 +47,14 @@ steps:
     sudo: true
     changed_when: "false"
 
+  - name: Create the Phase-2 LoRA publish dir (ComfyUI loras/trained, group-writable)
+    # 2775 (not 2770): world-readable + traversable so ComfyUI (uid 1025 comfytoo) can list +
+    # load; group arbotrain + group-WRITE so the worker (llmuser) can publish into it. setgid
+    # propagates the group to per-train subdirs (the Phase-1 group-write lesson).
+    shell: mkdir -p {{ loras_publish_dir }} && chgrp {{ group }} {{ loras_publish_dir }} && chmod 2775 {{ loras_publish_dir }}
+    sudo: true
+    changed_when: "false"
+
   - name: Create the install dir owned by the worker user
     shell: mkdir -p {{ install_dir }} && chown {{ worker_user }}:{{ worker_user }} {{ install_dir }}
     sudo: true