Strengthen marimo notebook conversion guidance

[ktaletsk]

Summary

This follow-up captures issues found while repairing and validating the Log
(Almost) Anything and Hugging Face notebooks in #652:

• preserve a user-designated live or exported molab notebook as the current
  implementation state, including cell order, identifiers, dependency metadata,
  and hide_code
• preserve readable teaching names; use private names only for actual
  cross-cell collisions or implementation-only plumbing
• consolidate signup, API-key, entity, and login guidance into exactly one
  reader-facing Authentication section, removing duplicate Colab-era prompts
• move %pip and !pip install requirements into PEP 723 metadata instead of
  replacing installation commands with subprocesses
• translate remaining shell commands by purpose, including fsspec for remote
  file access and subprocesses for programs that need a separate process
• document how a child process can inherit W&B configuration and expose its run
  URL before a blocking training command completes
• require widgets to render from their definition cells and use documented
  reactive state such as .value, not invented attributes such as .clicked
• require a fresh post-edit runtime smoke test because marimo check cannot
  detect invisible widgets or invalid runtime attributes
• document YouTube iframe embeds, the tested W&B light/dark logo pair, and the
  verified :host-context(body.dark) selector inside a marimo callout
• preserve a working fsspec backend; use GitHubFS for repository browsing and
  raw HTTPS when a demonstrated API-limit or known-file use case calls for it
• document in-memory W&B adapters for MP4, audio, HTML, and OBJ content
• preserve an existing tutorial ending instead of requiring generic
  verification and next-step prose
• keep live credentials, remote writes, commits, pushes, and PR changes behind
  explicit user authorization

Why

The saved conversion check for the media notebook predated a later cleanup
pass. That cleanup still passed without fresh runtime validation, leaving
controls invisible, .clicked references broken, duplicated public names, and
local asset paths unavailable in molab.

Subsequent live validation showed that cleanup guidance must preserve working
notebook choices instead of applying speculative rewrites. GitHubFS worked with
repository-relative paths and provided browsable remote storage; bare HTTPFS
could open concrete URLs but could not list a root. The final molab artifact
also restored readable teaching names and retained intentional hide_code
settings.

The Hugging Face notebook then exposed additional repeatable conversion issues:
duplicate signup and authentication prompts, package installation cells that
were redundant with script metadata, theme CSS inside a callout, and a W&B run
created by a blocking child process whose dashboard link should be available
while training streams.

Validation

• skill validator: Skill is valid!
• git diff --check
• independent review of the authentication, metadata, subprocess, filesystem,
  authorization, naming, and theme guidance

This PR is intentionally stacked on wandbify_skills / #647.