Studio diffusion (Phase 9): gate request-supplied local prequant paths behind operator opt-in

load_prequantized_transformer ends in torch.load(weights_only=False), which executes
arbitrary code from the pickle. The transformer_prequant_path load-request field reached
that unpickle for any local file an authenticated caller named, so a request could trigger
remote code execution. Refuse the source.kind=='path' branch unless the operator sets
UNSLOTH_ALLOW_LOCAL_PREQUANT_PATH=1; the first-party hosted-repo checkpoint stays trusted
and unaffected. Document the requirement on the API field and add gate tests.

studio/backend/tests/test_diffusion_prequant.py

@@ -143,9 +143,16 @@ def _load(
     scheme = "fp8",
     load_raises = False,
     exists = True,
+    allow_local = True,
 ):
     _FakeTransformer.calls = {}
     _stub_torch_accelerate(monkeypatch, ckpt, load_raises = load_raises)
+    # The local-path branch is opt-in (it unpickles an arbitrary file); these tests
+    # exercise the load mechanics, so enable it unless a test is checking the gate.
+    if allow_local:
+        monkeypatch.setenv(pq.ALLOW_LOCAL_PREQUANT_PATH_ENV, "1")
+    else:
+        monkeypatch.delenv(pq.ALLOW_LOCAL_PREQUANT_PATH_ENV, raising = False)
     path = tmp_path / "ckpt.pt"
     if exists:
         path.write_bytes(b"x")
@@ -195,3 +202,65 @@ def test_load_scheme_mismatch_is_none(monkeypatch, tmp_path):
 
 def test_load_base_mismatch_is_none(monkeypatch, tmp_path):
     assert _load(monkeypatch, tmp_path, _good_ckpt(base = "other/model")) is None
+
+
+# ── local-path opt-in gate (RCE guard) ───────────────────────────────────────────
+def test_load_local_path_refused_by_default(monkeypatch, tmp_path):
+    # A valid checkpoint at a real file is still refused: torch.load must never run on a
+    # request-supplied path without the operator opt-in.
+    called = {"load": False}
+
+    def _explode(*a, **k):
+        called["load"] = True
+        raise AssertionError("torch.load must not run on a refused local path")
+
+    torch = types.ModuleType("torch")
+    torch.load = _explode
+    monkeypatch.setitem(sys.modules, "torch", torch)
+    monkeypatch.delenv(pq.ALLOW_LOCAL_PREQUANT_PATH_ENV, raising = False)
+
+    path = tmp_path / "ckpt.pt"
+    path.write_bytes(b"x")
+    source = PrequantSource(kind = "path", location = str(path), filename = None)
+    result = load_prequantized_transformer(
+        _FakeTransformer,
+        "Tongyi-MAI/Z-Image-Turbo",
+        source,
+        device = "cuda",
+        dtype = "bfloat16",
+        hf_token = None,
+        scheme = "fp8",
+        logger = None,
+    )
+    assert result is None
+    assert called["load"] is False
+
+
+def test_load_local_path_allowed_with_optin(monkeypatch, tmp_path):
+    assert _load(monkeypatch, tmp_path, _good_ckpt(), allow_local = True) is not None
+
+
+def test_load_repo_source_allowed_without_optin(monkeypatch, tmp_path):
+    # The hosted-repo branch is first-party and trusted: it loads with no opt-in env set.
+    _FakeTransformer.calls = {}
+    _stub_torch_accelerate(monkeypatch, _good_ckpt())
+    monkeypatch.delenv(pq.ALLOW_LOCAL_PREQUANT_PATH_ENV, raising = False)
+
+    downloaded = tmp_path / "transformer_fp8.pt"
+    downloaded.write_bytes(b"x")
+    hub = types.ModuleType("huggingface_hub")
+    hub.hf_hub_download = lambda repo_id, filename, token = None: str(downloaded)
+    monkeypatch.setitem(sys.modules, "huggingface_hub", hub)
+
+    source = PrequantSource(kind = "repo", location = "org/hosted-fp8", filename = "transformer_fp8.pt")
+    result = load_prequantized_transformer(
+        _FakeTransformer,
+        "Tongyi-MAI/Z-Image-Turbo",
+        source,
+        device = "cuda",
+        dtype = "bfloat16",
+        hf_token = None,
+        scheme = "fp8",
+        logger = None,
+    )
+    assert result is not None