Refactor installation and runner scripts for enhanced usability and security

- Updated the installation script to clarify that production wrappers do not include fixed test secrets, improving user guidance for local testing.
- Modified the jiggablend-manager and jiggablend-runner scripts to remove fixed test configurations, emphasizing the use of local test credentials via `make init-test`.
- Enhanced error handling in the runner script to ensure that an API key is provided, improving security and user feedback.
- Added new flags and options for the runner, including sandboxing capabilities and GPU ray tracing control, enhancing flexibility for users.
- Improved README documentation to reflect changes in usage and configuration, ensuring users have clear instructions for setup and execution.

internal/auth/jobtoken_test.go

@@ -82,3 +82,36 @@ func signClaimsForTest(claims []byte) []byte {
 	return h.Sum(nil)
 }
 
+func TestConfigureJobTokenTTLFromTimeouts(t *testing.T) {
+	prev := JobTokenTTL()
+	t.Cleanup(func() { SetJobTokenTTL(prev) })
+
+	// Short timeouts floor at DefaultJobTokenDuration
+	got := ConfigureJobTokenTTLFromTimeouts(60, 120)
+	if got < DefaultJobTokenDuration {
+		t.Fatalf("TTL %v below default %v", got, DefaultJobTokenDuration)
+	}
+
+	// Long encode timeout (24h) + skew must be reflected
+	got = ConfigureJobTokenTTLFromTimeouts(3600, 86400)
+	wantMin := 86400*time.Second + JobTokenSkew
+	if got < wantMin {
+		t.Fatalf("TTL %v < expected min %v for 24h encode", got, wantMin)
+	}
+
+	// Newly generated tokens must use the configured TTL
+	token, err := GenerateJobToken(1, 2, 3)
+	if err != nil {
+		t.Fatalf("GenerateJobToken: %v", err)
+	}
+	claims, err := ValidateJobToken(token)
+	if err != nil {
+		t.Fatalf("ValidateJobToken: %v", err)
+	}
+	// Exp should be roughly now+TTL (allow 30s clock skew in test)
+	remaining := time.Until(time.Unix(claims.Exp, 0))
+	if remaining < wantMin-30*time.Second {
+		t.Fatalf("token remaining lifetime %v too short, want ~%v", remaining, wantMin)
+	}
+}
+