Tighten CodeQL launch and path inputs

[vavo]

Summary

• route model pulls through single-entry manifest files so user input no longer lands in the CLI argv
• narrow TrainPilot to the managed TOML config and stop sending raw dataset paths from the UI
• switch Diffusion Pipe to dataset names plus managed run directories instead of client-provided config/output paths

Verification

• python3 -m py_compile apps/Portal/app.py apps/Portal/dpipe_api.py apps/Portal/services/models.py
• node --check apps/Portal/static/js/dpipe.js
• node --check apps/Portal/static/js/trainpilot.js