fix(ci): publish valid worker images

Normalize registry and release tag references before Buildx runs. Use process-local liveness so a control-plane outage does not restart a healthy worker container.

cmd/rsmon-worker/main.go

@@ -68,6 +68,9 @@ func main() {
 	if len(flag.Args()) > 0 && flag.Arg(0) == "health" {
 		os.Exit(healthCheck())
 	}
+	if len(flag.Args()) > 0 && flag.Arg(0) == "liveness" {
+		os.Exit(livenessCheck())
+	}
 
 	log.Println("rsmon-worker starting...")
 
@@ -586,3 +589,32 @@ func healthCheck() int {
 	fmt.Println("health check ok")
 	return 0
 }
+
+func livenessCheck() int {
+	httpCfg := distworker.HTTPConfigFromEnv()
+	host := httpCfg.Host
+	switch host {
+	case "", "0.0.0.0":
+		host = "127.0.0.1"
+	case "::", "[::]":
+		host = "::1"
+	}
+	endpoint := "http://" + net.JoinHostPort(host, strconv.Itoa(httpCfg.Port)) + "/healthz"
+	return probeLiveness(endpoint)
+}
+
+func probeLiveness(endpoint string) int {
+	client := &http.Client{Timeout: 5 * time.Second}
+	resp, err := client.Get(endpoint)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "liveness check failed: %v\n", err)
+		return 1
+	}
+	defer resp.Body.Close() //nolint:errcheck
+	if resp.StatusCode != http.StatusOK {
+		fmt.Fprintf(os.Stderr, "liveness check failed: status %s\n", resp.Status)
+		return 1
+	}
+	fmt.Println("liveness check ok")
+	return 0
+}