fix(lora-worker): allowlist /storetank/arbo/models as the canonical base-model root

The first real arbo train 422'd: SDXL checkpoints live at
/storetank/arbo/models/checkpoints/ (the 2026-06-13 move to the 1.8TB
/storetank volume), which wasn't in ALLOWED_MODEL_ROOTS — the old roots
predated the move (/worktank/models is gone, /worktank/comfyui host path
is empty; ComfyUI mounts /storetank/arbo/models -> /basedir/models inside
its container). Allowlist /storetank/arbo/models (llmuser-readable,
world-readable tree), drop the two stale roots. Regression test added (15 green).

services/lora-training-worker/worker/config.py

@@ -34,12 +34,19 @@ SDXL_TRAIN_SCRIPT = SD_SCRIPTS_DIR / "sdxl_train_network.py"
 # dataset_dir + output_dir MUST live under the shared handoff root (the group-shared,
 # setgid /worktank/arbo/train that both arbo-container-uid and llmuser can rw). base_model
 # must live under a known model root. Anything else → rejected before a process is spawned.
+# base_model must be an absolute HOST path (the worker runs on the host, not in arbo's
+# container — a container-internal path like /comfy/... or /basedir/... won't match).
+#   /storetank/arbo/models — canonical model store (SDXL checkpoints; the 2026-06-13 move
+#     to the 1.8TB /storetank volume; arbo mounts it → /basedir/models inside its container).
+#   /opt/fluxgym/models — fluxgym base models (flux; Phase 4).
+#   /worktank/arbo — handoff root (a base staged into the handoff, if ever).
+# (Dropped the pre-move /worktank/models [gone] + /worktank/comfyui [empty host path] roots.)
 HANDOFF_ROOT = Path(os.environ.get("LORA_WORKER_HANDOFF_ROOT", "/worktank/arbo/train"))
 ALLOWED_MODEL_ROOTS = tuple(
     Path(p)
     for p in os.environ.get(
         "LORA_WORKER_MODEL_ROOTS",
-        "/opt/fluxgym/models:/worktank/comfyui:/worktank/models:/worktank/arbo",
+        "/storetank/arbo/models:/opt/fluxgym/models:/worktank/arbo",
     ).split(":")
     if p
 )