feat(run-manager): add --permissionless flag to join-authorization-create

[Sahilvishnaliya]

Summary

Making a run permissionless currently requires knowing the magic authorizer address \11111111111111111111111111111111\ (the Solana system program id), which #471 calls out as obscure.

Adds a --permissionless\ flag to
un-manager join-authorization-create:

\\sh

before

run-manager join-authorization-create --authorizer 11111111111111111111111111111111 ...

after

run-manager join-authorization-create --permissionless ...
\\

• --authorizer\ is now optional and mutually exclusive with --permissionless\ (passing both errors with an explanation)
• the permissionless grant targets \system_program::ID, the same address the client-side join check already treats as the permissionless grantee (\can_user_join_run\ in \coordinator_client.rs)
• \scripts/create-permissionless-run.sh\ updated to use the new flag
• book's \�uthentication.md\ updated to document the flag and explain what the magic address actually is

Closes #471.

Notes

• Backward compatible: --authorizer 11111111111111111111111111111111\ still works identically.
• Follows the existing command conventions (bool flag with \default_value_t = false, same as --delegates-clear).