feat(worker): one-command packaging and --check install verification

Adds scripts/publish.ps1, which produces a self-contained single-file exe plus
the headless AE build script, optionally zipped for copying to a render machine.

Adds `VFXReviewWorker.exe --check`: resolves every configured path, confirms
aerender/AfterFX/the build script exist, verifies each pathMappings target is
reachable from that machine, and pings the server to confirm the API key is
accepted — exiting non-zero if anything would stop the worker running. Catches
a wrong path at install time rather than in the logs later.

Verified from the published binary: the single-file exe resolves its scripts
folder correctly, so the preview build script ships alongside the exe rather
than embedded and can be patched without a rebuild.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

RenderWorker/README.md

@@ -63,16 +63,47 @@ the artist's AEP (then it is pure `aerender`), or the ffmpeg engine.
 
 Preview generation (Phase 4) and validation (Phase 3) plug into this same service later.
 
-## Build
+## Packaging for another machine
 
-Requires the .NET 8+ SDK.
+On a machine with the .NET 8+ SDK (only the packaging machine needs it):
 
-```bash
-cd RenderWorker/VFXReviewWorker
-dotnet publish -c Release -r win-x64 --self-contained -p:PublishSingleFile=true -o publish
+```powershell
+.\scripts\publish.ps1 -Zip
 ```
 
-Produces a single `publish/VFXReviewWorker.exe` — no runtime install needed on render nodes.
+Produces `publish\win-x64\` containing exactly two things: a self-contained
+`VFXReviewWorker.exe` (~67 MB, no .NET runtime needed on the target) and
+`scripts\vfxr_build_preview.jsx`, which the exe loads from its own folder at
+runtime. **Keep them together** — the script is deliberately not embedded in the
+exe so the slate/preview build can be patched without a rebuild. `-Zip` also
+writes `VFXReviewWorker_<date>.zip` for copying.
+
+### Installing on the target
+
+1. Copy the folder to the render machine, e.g. `C:\pipeline\VFXReviewWorker`.
+2. Create `C:\ProgramData\VFXReviewWorker\config.json` (next section).
+3. **Verify before installing the service:**
+
+   ```powershell
+   .\VFXReviewWorker.exe --check
+   ```
+
+   This resolves every path, confirms `aerender.exe` / `AfterFX.com` / the build
+   script exist, checks each `pathMappings` target is reachable *from that
+   machine*, and pings the server to confirm the API key is accepted. It exits
+   non-zero if anything would stop the worker running, so a wrong path is caught
+   here instead of in the logs an hour later.
+
+4. Install the service (below), then confirm the machine appears on the web
+   **Pipeline → Machines** page.
+
+Run `--check` again under the *service account* (`runas /user:STUDIO\svc-render`)
+if the service will run as someone other than the logged-in artist — mapped
+drives and share permissions differ per account, and that is the most common
+cause of a worker that registers fine but cannot find footage.
+
+Upgrading later: stop the service, replace the folder, start it again. Config
+lives in ProgramData and is untouched.
 
 ## Configure