Refactor installation and runner scripts for enhanced usability and security

- Updated the installation script to clarify that production wrappers do not include fixed test secrets, improving user guidance for local testing.
- Modified the jiggablend-manager and jiggablend-runner scripts to remove fixed test configurations, emphasizing the use of local test credentials via `make init-test`.
- Enhanced error handling in the runner script to ensure that an API key is provided, improving security and user feedback.
- Added new flags and options for the runner, including sandboxing capabilities and GPU ray tracing control, enhancing flexibility for users.
- Improved README documentation to reflect changes in usage and configuration, ensuring users have clear instructions for setup and execution.

internal/auth/secrets.go

@@ -3,6 +3,7 @@ package auth
 import (
 	"crypto/rand"
 	"crypto/sha256"
+	"crypto/subtle"
 	"database/sql"
 	"encoding/hex"
 	"fmt"
@@ -121,9 +122,13 @@ func (s *Secrets) ValidateRunnerAPIKey(apiKey string) (int64, string, error) {
 		return 0, "", fmt.Errorf("API key is required")
 	}
 
-	// Check fixed API key first (from database config)
+	// Check fixed API key first (from database config). Constant-time compare.
+	// Fixed keys are refused entirely when production mode is on.
 	fixedKey := s.cfg.FixedAPIKey()
-	if fixedKey != "" && apiKey == fixedKey {
+	if fixedKey != "" && subtle.ConstantTimeCompare([]byte(apiKey), []byte(fixedKey)) == 1 {
+		if s.cfg.IsProductionMode() {
+			return 0, "", fmt.Errorf("fixed API key is not allowed in production mode")
+		}
 		// Return a special ID for fixed API key (doesn't exist in database)
 		return -1, "manager", nil
 	}