Refactor installation and runner scripts for enhanced usability and security

- Updated the installation script to clarify that production wrappers do not include fixed test secrets, improving user guidance for local testing.
- Modified the jiggablend-manager and jiggablend-runner scripts to remove fixed test configurations, emphasizing the use of local test credentials via `make init-test`.
- Enhanced error handling in the runner script to ensure that an API key is provided, improving security and user feedback.
- Added new flags and options for the runner, including sandboxing capabilities and GPU ray tracing control, enhancing flexibility for users.
- Improved README documentation to reflect changes in usage and configuration, ensuring users have clear instructions for setup and execution.

web/static/job_show.js

@@ -259,13 +259,20 @@
       return;
     }
 
+    const escapeHtml = (value) => String(value ?? "")
+      .replaceAll("&", "&")
+      .replaceAll("<", "&lt;")
+      .replaceAll(">", "&gt;")
+      .replaceAll('"', "&quot;")
+      .replaceAll("'", "&#39;");
     output.innerHTML = filtered.map((entry) => {
       const level = String(entry.log_level || "INFO").toUpperCase();
-      const step = entry.step_name ? ` <span class="log-step">(${entry.step_name})</span>` : "";
-      const message = String(entry.message || "").replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+      const stepName = entry.step_name ? escapeHtml(entry.step_name) : "";
+      const step = stepName ? ` <span class="log-step">(${stepName})</span>` : "";
+      const message = escapeHtml(entry.message || "");
       return `<div class="log-line">
-        <span class="log-time">${formatTime(entry.created_at)}</span>
-        <span class="log-level ${levelClass(level)}">${level}</span>${step}
+        <span class="log-time">${escapeHtml(formatTime(entry.created_at))}</span>
+        <span class="log-level ${levelClass(level)}">${escapeHtml(level)}</span>${step}
         <span class="log-message">${message}</span>
       </div>`;
     }).join("");