Refactor installation and runner scripts for enhanced usability and security

- Updated the installation script to clarify that production wrappers do not include fixed test secrets, improving user guidance for local testing.
- Modified the jiggablend-manager and jiggablend-runner scripts to remove fixed test configurations, emphasizing the use of local test credentials via `make init-test`.
- Enhanced error handling in the runner script to ensure that an API key is provided, improving security and user feedback.
- Added new flags and options for the runner, including sandboxing capabilities and GPU ray tracing control, enhancing flexibility for users.
- Improved README documentation to reflect changes in usage and configuration, ensuring users have clear instructions for setup and execution.

README.md

@@ -157,10 +157,24 @@ bin/jiggablend runner --manager http://localhost:8080 --name my-runner --api-key
 # Hardware compatibility flag (force CPU)
 bin/jiggablend runner --api-key <key> --force-cpu-rendering
 
+# Sandbox Blender with rootless Podman (default; contains job Python/addons; manager I/O stays in the runner)
+# podman (default) | none (host Blender, no container)
+bin/jiggablend runner --api-key <key>                    # sandbox=podman by default
+bin/jiggablend runner --api-key <key> --sandbox none     # disable sandbox
+# Optional: allow network inside the jail (default off)
+# bin/jiggablend runner --api-key <key> --sandbox-network
+
 # Using environment variables
 JIGGABLEND_MANAGER=http://localhost:8080 JIGGABLEND_API_KEY=<key> bin/jiggablend runner
 ```
 
+### Blender sandbox notes
+
+- **Blender versions** are still the manager-served Linux tarballs on the host; they are **bind-mounted** into the container (no per-version Blender images).
+- **GPU**: host devices/libs are attached from detection (NVIDIA `/dev/nvidia*`, AMD `/dev/kfd`+`/dev/dri`+ROCm paths, Intel DRM). Requires the runner user to already have access to those devices on the host.
+- **podman**: rootless podman + default thin image `registry.fedoraproject.org/fedora-minimal:41` (override with `--sandbox-image`).
+
+
 ### Render Chunk Size Note
 
 For one heavy production scene/profile, chunked rendering (`frames 800-804` in one Blender process) was much slower than one-frame tasks: