refactor: address whole-repo code review findings

- split _rmsd_matrix.py: extract numba kernel to _rmsd_matrix_numba.py
  and dedupe 3 copies of QCP Newton-Raphson into a backend-agnostic
  _rmsd_qcp_block(xp, ...) shared by torch / jax / cupy backends
- replace assert-as-guard in pinned-D2H pipeline with a _PinnedChunk
  NamedTuple so prev state is atomic and survives python -O
- promote _average_rmsf_with_sem to public average_rmsf_with_sem and
  re-export from mdpp.analysis (was a cross-module private import)
- annotate GPU helpers with ModuleType + explicit return types
- harden mdrun{,_mpi_plumed}.sbatch with set -euo pipefail
- fix dtn_download.sh -e quoting bug; validate remote subdirectory
  names; make LOGIN_HOST / DTN_HOST / OPENFE_CONTAINER env-overridable
- replace Unicode A-ring / superscript-2 in plot labels with LaTeX
  equivalents (rendered output unchanged)
- silence 18 RDKit-stub mypy errors with targeted type-ignore comments
- replace __import__('multiprocessing') with a normal top-level import
- remove dead torch_mod parameter from _rmsd_torch_row_chunk

543 CPU + 69 GPU tests pass; mypy + ruff + shellcheck green.

Author: FridrichMethod

scripts/gromacs/data_transfer/dtn_download.sh

@@ -17,12 +17,14 @@ EOF
     exit 1
 }
 
-LOGIN_HOST="sherlock-plain"
-DTN_HOST="sherlock-dtn"
+# Override LOGIN_HOST / DTN_HOST in the environment for non-Sherlock deployments.
+# Defaults match the Sherlock cluster SSH aliases used by this group.
+LOGIN_HOST="${LOGIN_HOST:-sherlock-plain}"
+DTN_HOST="${DTN_HOST:-sherlock-dtn}"
 JOBS=0
 DRY_RUN=""
 
-SSH_OPTS="ssh -T -c aes128-gcm@openssh.com -o Compression=no -o ServerAliveInterval=60"
+SSH_OPTS=(ssh -T -c aes128-gcm@openssh.com -o Compression=no -o ServerAliveInterval=60)
 
 while [[ $# -gt 0 ]]; do
     case "$1" in
@@ -71,6 +73,16 @@ mapfile -t SUBDIRS < <(
     exit 1
 }
 
+# Validate remote-supplied subdirectory names: a compromised or malformed remote
+# could return entries with shell metacharacters or leading dashes that would be
+# misread as rsync flags by GNU parallel's command construction.
+for subdir in "${SUBDIRS[@]}"; do
+    if [[ ! "$subdir" =~ ^[A-Za-z0-9_.][A-Za-z0-9_./-]*$ ]]; then
+        echo "Error: refusing unsafe subdirectory name from remote: $subdir" >&2
+        exit 1
+    fi
+done
+
 # Default to one job per subdirectory if -j was not specified.
 [[ "$JOBS" -eq 0 ]] && JOBS=${#SUBDIRS[@]}
 
@@ -84,8 +96,8 @@ RSYNC_OPTS=(-ahP --append-verify)
 
 parallel -j "$JOBS" --bar --joblog "$LOGDIR/joblog.tsv" \
     rsync "${RSYNC_OPTS[@]}" \
-    -e "'$SSH_OPTS'" \
-    --log-file="'$LOGDIR/{}.log'" \
+    -e "${SSH_OPTS[*]}" \
+    --log-file="$LOGDIR/{}.log" \
     "$DTN_HOST:$REMOTE_DIR/{}/" \
     "$LOCAL_DIR/{}/" \
     ::: "${SUBDIRS[@]}"

scripts/gromacs/mdrun/mdrun.sbatch

@@ -13,6 +13,8 @@
 #SBATCH --constraint="GPU_SKU:A100_PCIE|GPU_SKU:A100_SXM4|GPU_SKU:A40|GPU_SKU:H100_SXM5|GPU_SKU:H200_SXM5|GPU_SKU:L40S|GPU_SKU:V100_PCIE|GPU_SKU:V100S_PCIE|GPU_SKU:V100_SXM2"
 #SBATCH --time=2-00:00:00
 
+set -euo pipefail
+
 ml gcc/12.4.0
 ml cmake/3.31.4
 ml make/4.4

scripts/gromacs/mdrun/mdrun_mpi_plumed.sbatch

@@ -13,6 +13,8 @@
 #SBATCH --mem-per-gpu=8G
 #SBATCH --time=2-00:00:00
 
+set -euo pipefail
+
 ml gcc/12.4.0
 ml cmake/3.31.4
 ml make/4.4

scripts/openfe/quickrun/quickrun.sbatch

@@ -19,7 +19,9 @@
 
 set -euo pipefail
 
-OPENFE_CONTAINER=/scratch/groups/ayting/containers/openfe/openfe_latest-apptainer.sif
+# Override OPENFE_CONTAINER (apptainer .sif) via the environment for non-Sherlock
+# or non-ayting-group deployments; the default below is the Sherlock ayting path.
+OPENFE_CONTAINER="${OPENFE_CONTAINER:-/scratch/groups/ayting/containers/openfe/openfe_latest-apptainer.sif}"
 
 usage() {
     cat >&2 <<EOF

src/mdpp/analysis/__init__.py

@@ -27,6 +27,7 @@
 from mdpp.analysis.fes import compute_fes_2d, compute_fes_from_projection
 from mdpp.analysis.hbond import compute_hbonds, format_hbond_triplets
 from mdpp.analysis.metrics import (
+    average_rmsf_with_sem,
     compute_dccm,
     compute_delta_rmsf,
     compute_radius_of_gyration,
@@ -43,6 +44,7 @@
     "KMeans",
     "MiniBatchKMeans",
     "RegularSpace",
+    "average_rmsf_with_sem",
     "compute_contact_frequency",
     "compute_contacts",
     "compute_dccm",