feat(lora-worker): add optional train_id to POST /train (explicit publish-path namespace)

comfy-dev's explicit-over-implicit call: arbo now sends train_id, so the
worker no longer derives the loras/trained/{train_id}/ namespace from
output_dir.parent (which coupled it to arbo's handoff layout). train_id is
optional + path-safe-validated; when present it wins, else the path
derivation remains as the fallback. Wired through TrainRequest ->
validate_request -> published_relative_path -> _publish_lora. 18 tests green.

services/lora-training-worker/tests/test_invocation.py

@@ -107,6 +107,21 @@ def test_published_relative_path():
     ) == "trained/392cf898ac03/sindra_lora.safetensors"
 
 
+def test_published_relative_path_explicit_train_id_wins():
+    # explicit train_id (arbo now sends it) takes precedence over the path-derived fallback
+    assert published_relative_path(
+        "/worktank/arbo/train/whatever/output", "sindra_lora", train_id="abc123"
+    ) == "trained/abc123/sindra_lora.safetensors"
+
+
+def test_train_id_optional_and_validated():
+    # absent -> OK (falls back to derivation); present+safe -> OK; present+unsafe -> 422
+    build_command(_req())  # no train_id key
+    build_command(_req(train_id="392cf898ac03"))
+    with pytest.raises(InvalidTrainRequest, match="train_id"):
+        build_command(_req(train_id="../../etc"))
+
+
 def test_storetank_checkpoint_allowed():
     # the canonical SDXL store (2026-06-13 move) — arbo dispatches base_model_path from here
     argv, _, _ = build_command(