LoRA handoff: integrity is not deployability

Reusable review insight: treat a hash-verified LoRA package as an artifact-transfer success, not proof of deployment compatibility. A handoff should also bind the serving runtime/commit, base + tokenizer/prompt contract, threshold semantics, loader/export command, and pass/fail replay criteria. PEFT LoRA can generally be merged for the modules it actually targets; all-linear is not required merely to call an individual adapter merge. Combining two independently trained adapters is a separate, unvalidated behavior change. Provenance: derived from a 2026-09-03 review of the COR-3791 adapter handoff against the local ender-inference serving/export paths; no package hashes, credentials, datasets, or private artifacts included.