feat(worker): one-command packaging and --check install verification

Adds scripts/publish.ps1, which produces a self-contained single-file exe plus
the headless AE build script, optionally zipped for copying to a render machine.

Adds `VFXReviewWorker.exe --check`: resolves every configured path, confirms
aerender/AfterFX/the build script exist, verifies each pathMappings target is
reachable from that machine, and pings the server to confirm the API key is
accepted — exiting non-zero if anything would stop the worker running. Catches
a wrong path at install time rather than in the logs later.

Verified from the published binary: the single-file exe resolves its scripts
folder correctly, so the preview build script ships alongside the exe rather
than embedded and can be patched without a rebuild.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

RenderWorker/VFXReviewWorker/Program.cs

@@ -11,6 +11,14 @@ using VFXReviewWorker;
 // Install as a service:             see RenderWorker/README.md
 
 var configPath = args.FirstOrDefault(a => !a.StartsWith('-'));
+
+// Install verification on a new machine — resolves paths, checks tools and
+// pings the server, then exits. Never starts the service loop.
+if (args.Any(a => a.Equals("--check", StringComparison.OrdinalIgnoreCase)))
+{
+    return await Preflight.RunAsync(configPath);
+}
+
 var options = WorkerOptions.Load(configPath);
 
 // Positional args (config path) are consumed above and deliberately not
@@ -28,3 +36,4 @@ builder.Services.AddSingleton<JobExecutor>();
 builder.Services.AddHostedService<WorkerService>();
 
 await builder.Build().RunAsync();
+return 0;