fix(ci): publish valid worker images

Normalize registry and release tag references before Buildx runs. Use process-local liveness so a control-plane outage does not restart a healthy worker container.

cmd/rsmon-worker/main.go

@@ -68,6 +68,9 @@ func main() {
 	if len(flag.Args()) > 0 && flag.Arg(0) == "health" {
 		os.Exit(healthCheck())
 	}
+	if len(flag.Args()) > 0 && flag.Arg(0) == "liveness" {
+		os.Exit(livenessCheck())
+	}
 
 	log.Println("rsmon-worker starting...")
 
@@ -586,3 +589,32 @@ func healthCheck() int {
 	fmt.Println("health check ok")
 	return 0
 }
+
+func livenessCheck() int {
+	httpCfg := distworker.HTTPConfigFromEnv()
+	host := httpCfg.Host
+	switch host {
+	case "", "0.0.0.0":
+		host = "127.0.0.1"
+	case "::", "[::]":
+		host = "::1"
+	}
+	endpoint := "http://" + net.JoinHostPort(host, strconv.Itoa(httpCfg.Port)) + "/healthz"
+	return probeLiveness(endpoint)
+}
+
+func probeLiveness(endpoint string) int {
+	client := &http.Client{Timeout: 5 * time.Second}
+	resp, err := client.Get(endpoint)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "liveness check failed: %v\n", err)
+		return 1
+	}
+	defer resp.Body.Close() //nolint:errcheck
+	if resp.StatusCode != http.StatusOK {
+		fmt.Fprintf(os.Stderr, "liveness check failed: status %s\n", resp.Status)
+		return 1
+	}
+	fmt.Println("liveness check ok")
+	return 0
+}

cmd/rsmon-worker/main_test.go

@@ -0,0 +1,33 @@
+package main
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestProbeLiveness(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name string
+		code int
+		want int
+	}{
+		{name: "healthy", code: http.StatusOK, want: 0},
+		{name: "unhealthy", code: http.StatusServiceUnavailable, want: 1},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+				w.WriteHeader(tt.code)
+			}))
+			defer srv.Close()
+
+			if got := probeLiveness(srv.URL); got != tt.want {
+				t.Fatalf("probeLiveness() = %d, want %d", got, tt.want)
+			}
+		})
+	}
+}