Add a reusable Nimbus worker execution skill

[arjunrajlab]

Summary

• add a focused nimbus-run-worker repository skill for executing built worker images against a real local NimbusImage/Girder dataset
• add a safe standard-library runner that resolves dataset-view URLs, mints and revokes a short-lived Girder token, validates the Docker image/network, snapshots folder items, invokes the production worker CLI contract, and reports newly created items
• document worker-specific payload construction, live-mutation safeguards, API/tiles/frontend verification, and the distinction between direct Docker execution and Celery queue dispatch
• route the existing nimbus-interface and nimbus-worker-scaffold skills to the new execution workflow

Safety

• --dry-run performs no API or Docker calls and prints only a redacted command
• --preflight-only checks auth, dataset resolution, image, and network without starting the worker
• the long-lived API key is never passed to Docker; the temporary token is revoked in finally, including worker failures
• the helper never deletes or replaces an existing Girder item

Validation

• python3 -m unittest discover -s .agents/skills/nimbus-run-worker/tests -v — 6 passed
• quick_validate.py .agents/skills/nimbus-run-worker — valid
• flake8 --ignore=E203,E501,W503 ... — passed
• git diff --cached --check — passed before commit
• real Well_2 --preflight-only check resolved dataset folder 6a941e20d233ea7fbc4328e1, found the existing illumination worker image/network and 3 folder items, and reported worker_started: false

The prior successful Well_2 execution is documented as the motivating workflow; this PR deliberately did not launch another correction run or create another multi-gigabyte output.