chore(r49): stage lv-mccarthy ckpt300 on fv-ml1, and guard the ship script against a local ~

The adapter is STAGED, NOT SHIPPED: adapter_config.json and
adapter_model.safetensors are in /tank/aimodels/voice-adapters/lv-mccarthy-4b-v1
on fv-ml1, verified byte-identical to gx10's checkpoint-300 at the source, after
the local hop and at the destination. The seat CANNOT load it -- nothing in
--lora-modules references it -- and /v1/models was checked after staging and still
serves exactly the three registered voices plus base.

The adapter carries a README recording the full gate result AND its cost, so it
cannot be read as clean by anyone who finds the directory without the gate record.
A copy is committed at scripts/mccarthy-corpus/gate-results/ADAPTER-README.md for
review. It leads with "STAGED, NOT SHIPPED" and says that if lv-mccarthy is absent
from the seat's model list, the decision has not been made.

The compose edit that would actually register it is prepared in the working tree
and deliberately LEFT UNCOMMITTED. stacks/ is canonical intent that deploy-stack.sh
reads; committing it would assert an intent that is precisely the open question.

Ship-script fix: <run-dir> must be an absolute REMOTE path. A leading ~ is expanded
by the local shell, so ~/r49-runs/... became /home/lkraven/... and gx10 answered
"Permission denied" -- a confusing error for a path problem. It now refuses a
non-absolute path outright, with the reason. Verified: the guard fires on a ~ path
and the real staging succeeded on the absolute one.

scripts/r49-corpus/ship-voice-adapter.sh

@@ -2,7 +2,12 @@
 # Ship an r49 voice LoRA from the training box to the voices seat's adapter store.
 #
 #   scripts/r49-corpus/ship-voice-adapter.sh <run-dir> <checkpoint> <adapter-name>
-#   e.g. ... ~/r49-runs/mccarthy-4b-pairs-3ep checkpoint-900 lv-mccarthy-4b-v1
+#   e.g. ... /home/infra-ops/r49-runs/mccarthy-4b-pairs-3ep checkpoint-300 lv-mccarthy-4b-v1
+#
+# ⚠ <run-dir> MUST BE AN ABSOLUTE REMOTE PATH. A leading `~` is expanded by the LOCAL
+# shell before the script sees it, so `~/r49-runs/...` becomes /home/lkraven/... and the
+# source read fails with "Permission denied" on gx10 -- a confusing error for a path
+# problem. The guard below refuses it outright rather than letting ssh report it.
 #
 # Run from nh3-dev. gx10 and fv-ml1 both hold only authorized_keys, so neither can
 # INITIATE to the other -- the relay through this box is the path, and it costs nothing
@@ -26,6 +31,12 @@ NAME=${3:?missing adapter name}
 SRC_HOST=${SRC_HOST:-infra-ops@10.100.50.60}       # pfi-gx10
 DST_HOST=${DST_HOST:-infra-ops@10.251.50.54}       # fv-ml1
 DST_ROOT=${DST_ROOT:-/tank/aimodels/voice-adapters}
+case "$RUN" in
+  /*) ;;
+  *) echo "== REFUSING: <run-dir> must be an ABSOLUTE remote path, got '$RUN'."
+     echo "   A leading ~ is expanded by the local shell and will point at the wrong user."
+     exit 2 ;;
+esac
 STAGE=$(mktemp -d)
 trap 'rm -rf "$STAGE"' EXIT