Fix COMMAG Compose write permissions

[vtavakkoli]

Root cause

The COMMAG GitHub Actions job created bind-mounted host directories as the runner user, but the COMMAG Compose services kept the image UID (10001). The non-root container therefore could not create /workspace/data/raw/commag/....

Fix

• map commag-prepare, commag-train, and commag-test to LOCAL_UID:LOCAL_GID in compose.override.yaml
• bind-mount ./artifacts for the training and validation services, matching the existing real-data services
• pass the GitHub runner UID/GID to every COMMAG CI invocation
• document the portable Linux invocation in README and docs/COMMAG.md

This retains non-root execution and avoids sudo, root containers, or world-writable directories.

Validation

• pytest -q: 26 passed
• critical Ruff checks: passed
• Python compileall: passed
• workflow and Compose YAML parsing: passed
• git diff --check: passed

This is a follow-up to merged PR #62, whose COMMAG job exposed the permission mismatch.