feat(sandbox): add read-only Xquik Skill image

[kriptoburak]

Summary

Add a dedicated OpenShell sandbox for the public Xquik Twitter scraper Skill.

The base sandbox has neither the Skill nor an Xquik provider policy. Installing the Skill alone leaves its API and documentation requests blocked by OpenShell's default-deny network policy.

This change:

• pins the public Skill to commit 5f2a6d1251dbf9bc5a1211a085d6cac2f2f689af
• copies the complete Skill and its MIT license into the image
• adds a provider profile for gateway-managed XQUIK_API_KEY injection
• limits the profile to GET, HEAD, and OPTIONS
• excludes MCP, extraction jobs, monitors, webhooks, and account actions
• documents setup, credential handling, network scope, and the private-read boundary

Related issue

None. This is a self-contained sandbox integration under the repository's documented contribution path.

Testing

• python3 scripts/check_license_headers.py --check
• parsed the profile with Ruby's YAML parser
• parsed and validated the profile with openshell-providers at NVIDIA/OpenShell commit 2f7fb65591ee5746217ace154afc0aa6bf1afc6d
• fetched the pinned Skill commit in a clean temporary Git repository
• verified the pinned tree contains SKILL.md, the security reference, and MIT license
• git diff --check

Docker is unavailable on the test host. The repository's sandbox workflow will build the image on this pull request.

Checklist

• The change is limited to one sandbox integration.
• The commit includes a DCO sign-off.
• No API key or local environment file is included.
• The Skill source and license are public and pinned.
• The main sandbox catalog is updated.