fix(lora): accept diffusion_model.* prefix and use pipe.load_lora hotload

ci: ruff + pytest on push/pr (l1+l2, no gpu deps)

feat(lora): applied_lora ctx manager — validate, apply, revert on exit

feat(lora): safetensors header sniff + zimage key validation