Refactor installation and runner scripts for enhanced usability and security

- Updated the installation script to clarify that production wrappers do not include fixed test secrets, improving user guidance for local testing.
- Modified the jiggablend-manager and jiggablend-runner scripts to remove fixed test configurations, emphasizing the use of local test credentials via `make init-test`.
- Enhanced error handling in the runner script to ensure that an API key is provided, improving security and user feedback.
- Added new flags and options for the runner, including sandboxing capabilities and GPU ray tracing control, enhancing flexibility for users.
- Improved README documentation to reflect changes in usage and configuration, ensuring users have clear instructions for setup and execution.

Makefile

@@ -55,16 +55,17 @@ run-manager: cleanup-manager build init-test
 run-runner: cleanup-runner build
 	bin/jiggablend runner -l runner.log --api-key=jk_r0_test_key_123456789012345678901234567890
 
-# Initialize for testing (first run setup)
+# Initialize for testing (local development only — never use these secrets in production)
 init-test: build
-	@echo "Initializing test configuration..."
+	@echo "Initializing LOCAL TEST configuration (not for production)..."
 	bin/jiggablend manager config enable localauth
 	bin/jiggablend manager config set fixed-apikey jk_r0_test_key_123456789012345678901234567890 -f -y
 	bin/jiggablend manager config add user test@example.com testpassword --admin -f -y
-	@echo "Test configuration complete!"
+	@echo "Test configuration complete (LOCAL DEV ONLY)!"
 	@echo "fixed api key: jk_r0_test_key_123456789012345678901234567890"
 	@echo "test user: test@example.com"
 	@echo "test password: testpassword"
+	@echo "WARNING: fixed API keys are refused when production_mode is enabled."
 
 # Clean bin build artifacts
 clean-bin: