Simplify AMD Wolf config and add uhid module auto-loading

Based on tested working AMD Wolf configuration, simplified docker-compose.yaml:

1. wolf-amd service (docker-compose.yaml:339-358):
   - REMOVED: security_opt: seccomp=unconfined (not needed)
   - REMOVED: group_add: video, render (not needed)
   - REMOVED: devices: /dev/kfd (already in /dev/ volume mount)
   - Kept: /dev/dri, /dev/uinput, /dev/uhid (explicit for clarity)
   - Note: /dev/:/dev/:rw volume mount provides all GPU access

2. runner.sh AMD flags (install.sh:2145):
   - REMOVED: --security-opt seccomp=unconfined
   - Kept: --device /dev/kfd --device /dev/dri (runners don't mount /dev/)
   - Kept: --group-add video --group-add render (for device access)

3. uhid kernel module auto-loading (install.sh:1309-1328):
   - Load uhid immediately: modprobe uhid
   - Configure auto-load on boot: /etc/modules-load.d/helix.conf
   - Required for Wolf virtual HID devices
   - Skipped on Git Bash (Windows doesn't have modprobe)

Edge case: Both NVIDIA and AMD GPUs present
- Priority: NVIDIA > AMD > Intel (if/elif logic)
- Result: Uses NVIDIA GPU, ignores AMD
- Reasonable: Can't use both simultaneously anyway

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: lukemarsden

docker-compose.yaml

@@ -338,7 +338,6 @@ services:
       - 'c 13:* rmw'
     devices:
       - /dev/dri
-      - /dev/kfd  # AMD ROCm Kernel Fusion Driver
       - /dev/uinput
       - /dev/uhid
     ports:
@@ -350,12 +349,8 @@ services:
       - "47999:47999/udp" # Control
       - "48100:48100/udp" # Video RTP
       - "48200:48200/udp" # Audio RTP
-    # No nvidia runtime for AMD - use device pass-through instead
-    security_opt:
-      - seccomp=unconfined  # Required for AMD GPU access
-    group_add:
-      - video  # Grant access to /dev/dri
-      - render # Grant access to GPU rendering
+    # No nvidia runtime for AMD - /dev/ volume mount provides GPU access
+    # No seccomp=unconfined or group_add needed - /dev/ volume provides access
     cap_add:
       - SYS_PTRACE  # Required to read /proc/<pid>/task/<tid>/syscall for thread diagnostics
     restart: unless-stopped

install.sh

@@ -1306,6 +1306,27 @@ if [ "$CODE" = true ] && [ "$RUNNER" = false ]; then
     fi
 fi
 
+# Load uhid kernel module for Helix Code (required for virtual HID devices in Wolf)
+if [ "$CODE" = true ]; then
+    echo "Loading uhid kernel module for virtual HID device support..."
+    if [ "$ENVIRONMENT" = "gitbash" ]; then
+        echo "Skipping uhid module loading on Windows Git Bash"
+    else
+        # Load module immediately
+        if sudo modprobe uhid 2>/dev/null; then
+            echo "✓ uhid module loaded"
+        else
+            echo "Warning: Failed to load uhid module - may already be loaded or built-in"
+        fi
+
+        # Make uhid auto-load on boot
+        if [ ! -f /etc/modules-load.d/helix.conf ] || ! grep -q "^uhid" /etc/modules-load.d/helix.conf; then
+            echo "uhid" | sudo tee -a /etc/modules-load.d/helix.conf > /dev/null
+            echo "✓ uhid module configured to auto-load on boot (/etc/modules-load.d/helix.conf)"
+        fi
+    fi
+fi
+
 # Create installation directories (platform-specific)
 if [ "$ENVIRONMENT" = "gitbash" ]; then
     mkdir -p "$INSTALL_DIR"
@@ -2121,7 +2142,7 @@ for i in \$(seq 1 \$SPLIT_RUNNERS); do
     elif [ "\$GPU_VENDOR" = "amd" ]; then
         # AMD: Use device pass-through + ROCR_VISIBLE_DEVICES env var
         # Note: ROCR_VISIBLE_DEVICES uses GPU IDs (0,1,2) same as CUDA
-        GPU_FLAGS="--device /dev/kfd --device /dev/dri --group-add video --group-add render --security-opt seccomp=unconfined"
+        GPU_FLAGS="--device /dev/kfd --device /dev/dri --group-add video --group-add render"
         ENV_FLAGS="-e ROCR_VISIBLE_DEVICES=\$GPU_DEVICES"
     else
         echo "Error: Unknown GPU_VENDOR: \$GPU_VENDOR"