Normally tmpfiles.d will handle this at boot time, but if you install lorax-composer without rebooting it was ending up with root:root ownership instead of root:weldr
Instead of enabling lorax-composer.service enable lorax-composer.socket and it will start lorax-composer on first access to /run/weldr/api.socket