Distinguish EACCES from ENOENT in the COMFY_DIR startup check

cmd/gpu-turnstile/main.go

@@ -518,14 +518,21 @@ func run(ctx context.Context, cfg config.Config, log *slog.Logger, logOut io.Wri
 	if comfyCmdLine != "" {
 		if cfg.ComfyCmd == "" {
 			// Derived from COMFY_DIR: flag a wrong-looking layout early,
-			// while the operator is still watching the startup log.
+			// while the operator is still watching the startup log. Inside
+			// a profile the service account may not enter, os.Stat fails
+			// with EACCES — that reads as "not found" but means "grant
+			// access", so say so.
 			python, script := supervise.ComfyLayout(runtime.GOOS, cfg.ComfyDir)
 			for _, p := range []string{python, script} {
 				if _, err := os.Stat(p); err != nil {
+					if isPermission(err) {
+						log.Warn("COMFY_DIR: not accessible to the service account; grant access or re-run --install-service", "path", p)
+					} else {
 						log.Warn("COMFY_DIR: file not found; ComfyUI requests will fail until it exists", "path", p)
 					}
 				}
 			}
+		}
 		var err error
 		comfySup, err = supervise.New("comfy", comfyCmdLine, cfg.ComfyDir, comfyClient.Probe, cfg.ComfyStartTimeout, log)
 		if err != nil {