[mkitti]

Summary

• Re-adds marimo/marimo-podman Fileglancer runnables (plain HTTP, no local Caddy/TLS layer) that were removed in 98ea8d8, for testing purposes.
• Compatible with Fileglancer's new per-job HTTPS proxy, JaneliaSciComp/fileglancer#440: once a deployment sets apps.service_proxy_domain, these jobs' published links are fetched over HTTPS end-to-end via Fileglancer's nginx proxy, even though Marimo itself only ever speaks plain HTTP on the compute node. Without that setting, the link is plain HTTP like before.
• Unlike the removed runnables (which did --token-password "$FG_SERVICE_TOKEN" directly on the command line), these pass no token flag at all — FG_SERVICE_TOKEN is already forwarded into the container's environment (common.sh's ENV_PAIRS allowlist), and container/entrypoint.sh resolves it from there.

⚠️ Sequencing dependency on #23

This PR is based on main, which does not yet include the entrypoint.sh fix from #23 (--token-password-file instead of --token-password on argv). On main today, entrypoint.sh's FG_SERVICE_TOKEN fallback still puts the token on marimo's command line — verified live: with main's entrypoint.sh, this reintroduces the exact argv-exposure issue #23 fixes. With #23's entrypoint.sh bind-mounted in for testing, the same command produces no token on any process's argv.

Recommendation: merge #23 before this PR (or merge this after #23, whichever lands first) so these runnables ship secure from the start. I did not rebase this branch onto #23's branch since it was requested off main, but happy to do so if preferred.

Test plan

• runnables.yaml parses as valid YAML with the expected 4 runnable ids (marimo, marimo-podman, marimo-https, marimo-podman-https)
• Live-simulated the marimo runnable's exact command (pixi run marimo-apptainer --port ... with FG_SERVICE_TOKEN set, no token flag) against the current image: confirmed marimo starts and enforces the token
• Confirmed the token appears on marimo's argv with main's current entrypoint.sh (expected, until Stop exposing service tokens via process command-line arguments #23 merges) and does not appear with Stop exposing service tokens via process command-line arguments #23's fixed entrypoint.sh bind-mounted in
• End-to-end test as a real Fileglancer job once deployed

🤖 Generated with Claude Code