Tier 2 of the lucidboxai ComfyUI stack modernization.

- Dockerfile: IMAGE_BASE -> ghcr.io/lucidboxai/base-image v2-cuda-12.6.3-
  cudnn-runtime-24.04; PYTHON_VERSION default 3.12, PYTHON_VENV_NAME
  default python_312; labels -> lucidboxai fork.
- layer0/common.sh: jupyter venv now built on python3.12 (Ubuntu 24.04
  native) instead of hardcoded python3.10.
- docker-build.yml: NVIDIA job -> Ubuntu 24.04, Python 3.12, CUDA
  12.6.3-cudnn-runtime, IMAGE_BASE from lucidboxai/base-image; GHCR-only
  publishing; checkout@v4 / build-push-action@v6; packages:write perms.
  CPU/AMD jobs keep ai-dock public bases (out of scope this pass).
- docker-compose.yaml: defaults retargeted to lucidboxai images.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Mirrors INFRA-001 from lucidboxai/base-image: triggers on
pull_request to main (paths-filtered to build/**) and on
workflow_dispatch. Builds the production nvidia 12.6.3-cudnn-runtime
+ py3.12 variant against the published base-image, push: false.

Closes the auto-CI gap for python so PORT-004 (and every subsequent
python PR) gets validation automatically. Expected ~6-10 min per run
vs docker-build.yml's full ~18-20 min.

The workflow pulls ghcr.io/lucidboxai/base-image so it also exercises
the base-image → python integration end-to-end on every PR.

…pth) (#2)

Closes the failure mode where bypassing Caddy (direct port-forward,
RunPod template publishing 8888 directly, future Caddy misconfig)
leaves Jupyter fully open. WEB_TOKEN is already always-set by
base-image init.sh (from OPEN_BUTTON_TOKEN on RunPod, otherwise a
random 32-char string), so no new env var operators must configure.
Operators wanting no-token Jupyter can opt out with WEB_TOKEN="".

Per ADR-004 in the lucidboxai-notes vault.

Same broken DELETE_PACKAGES_TOKEN pattern lucidboxai/base-image had,
inherited from ai-dock upstream verbatim. Same 3-changes-per-file
patch: add permissions: packages: write, drop github-token line,
bump actions/github-script@v6 → @v7.

INFRA-002 verified post-merge that GITHUB_TOKEN + packages: write is
sufficient for org-level package DELETE — so this mirror should
behave identically.

Mirror PORT-001's hygiene approach for the jupyter package install
in build/COPY_ROOT_0/opt/ai-dock/bin/build/layer0/common.sh. Changes
`jupyterlab notebook` (bare names, no version constraint) to
`jupyterlab>=4.2 notebook>=7.2` — supply-chain hardening and a clear
bump point without losing auto-patch behavior.

See vault Porting/PORT-005 for the audit + floor rationale.