Refactor installation and runner scripts for enhanced usability and security

- Updated the installation script to clarify that production wrappers do not include fixed test secrets, improving user guidance for local testing.
- Modified the jiggablend-manager and jiggablend-runner scripts to remove fixed test configurations, emphasizing the use of local test credentials via `make init-test`.
- Enhanced error handling in the runner script to ensure that an API key is provided, improving security and user feedback.
- Added new flags and options for the runner, including sandboxing capabilities and GPU ray tracing control, enhancing flexibility for users.
- Improved README documentation to reflect changes in usage and configuration, ensuring users have clear instructions for setup and execution.

internal/runner/tasks/encode.go

@@ -246,6 +246,8 @@ func (p *EncodeProcessor) Process(ctx *Context) error {
 		TwoPass:      true,
 	})
 	if err := pass1Cmd.Run(); err != nil {
+		// Pass 1 is analysis-only (writes to /dev/null). FFmpeg often exits non-zero
+		// on benign codec/option warnings while still producing passlogfile stats.
 		ctx.Warn(fmt.Sprintf("Pass 1 completed (warnings expected): %v", err))
 	}