Make templateflow + FS-license bind-mounts portable (re-executable provenance)

# Make templateflow + FS-license bind-mounts portable (re-executable provenance)

## Problem

fmriprep pipeline config has hardcoded ndoli abspaths for templateflow and the
FreeSurfer license bind-mounts. These land in the `singularity run` command
recorded in the `datalad run` commit — so the recorded run is **not
re-executable on other systems** (abspaths don't resolve elsewhere). Doesn't
block the shakeout, but it breaks provenance re-runnability → **M2**. Same
theme as #6 (abspaths in the run record's `-w` path).

## Fix

Env-var pattern: use `$TEMPLATEFLOW_DIR`, `$FS_LICENSE` in pipeline
`singularity_args`, set per-cluster in the cluster's `script_preamble`. Same
pattern for future containers-run bind-mounts.

Even if templateflow becomes a datalad subdataset of mechababs, relative paths
won't work — the singularity bind is passed from the babs analysis dir, not
mechababs.

## Concrete host-abspaths to strip (STAMPED audit 2026-07-04)

Every tracked-YAML abspath that leaks a host path out of the pipeline axis
(closes S.1 self-containment + P.1 portability + the M three-axis leak in one
pass). In `pipelines/fmriprep-full-25.2.5.yaml`:

- [ ] `singularity_args` — `-B /dartfs/.../templateflow:/templateflow` (templateflow bind)
- [ ] `singularity_args` — `-B /dartfs/.../license.txt:/SGLR/FREESURFER_HOME/license.txt` (FS-license bind)
- [ ] `bids_app_args` — `--fs-license-file: /dartfs/.../license.txt` (a **second** license abspath, distinct from the bind above)
- [ ] `input_datasets.fmriprep_anat.origin_url` — `ria+file:///dartfs/.../output_ria#~data` ("FIX ME PER RUN"). Overlaps the fan-out chaining work (#27) and the existing `--anat-ria` injection path in `merge_config.py`, which is where the real fix lives — but track it here so no abspath survives in a tracked pipeline YAML.

(Cluster preamble `/scratch/${USER}` and the `--fs-subjects-dir` `${PWD}`-relative
path are already parametrized — not in scope.)

## Next

- Implement the env-var pattern in pipeline + cluster configs.
- Discuss a shared templateflow location with Yarik (nice-to-have — Austin has
a working copy on ndoli, not blocking).

Audit pipelines/fmriprep-full-25.2.5.yaml for the listed host paths, then read the cluster script_preamble configurations and the existing --anat-ria injection path in merge_config.py. Verify that bind mounts and license arguments use per-cluster environment variables, no host abspath remains in tracked pipeline YAML, and the recorded run can be re-executed on another system.

Written by the indexing model from the issue text.