Validate worker auth token freshness

[kebanks2]

Summary

• fixes [ Bounty $10k ] [ Auth ] Check token not-before time on worker requests — worker auth #3596 by replacing the bearer-presence check with fail-closed worker token validation before /api/v2 handlers run
• rejects malformed, future-nbf, stale-by-global-cutoff, revoked, anonymous, underscoped, wrong-workspace, and missing-role worker principals
• preserves the authorized path by attaching validated claims to request.state.worker_claims for bearer-token and browser-cookie clients
• includes two current-main test-health fixes needed for API/full-suite validation: export AgentStatus from src.agent and make the metrics timer lock re-entrant

Validation

• python -m flake8 src/api/middleware.py tests/test_auth_middleware.py src/agent/__init__.py src/common/metrics.py
• python -m pytest -q -> 31 passed
• python -m py_compile src/api/middleware.py tests/test_auth_middleware.py src/agent/__init__.py src/common/metrics.py
• git diff --check
• star gate verified: gh repo view orchestration-agent/AgentOrchestration --json viewerHasStarred --jq '.viewerHasStarred' -> true

No secrets, tokens, hidden context, private runtime data, or payout details are included.