docs: plan HTTPS peers and source install

docs/implementation-roadmap.md

@@ -14,6 +14,9 @@ Worker repository:
 - verify amd64 and arm64 image startup, Chromium availability, and version
   metadata;
 - add a package/install smoke test for Docker and systemd artifacts;
+- add the Docker/OpenSSH source-install matrix for Alpine, Ubuntu, and Arch from
+  [source-installation.md](source-installation.md), using Go 1.26 and branch
+  `main`;
 - document immutable SHA and release tags as production defaults.
 
 Gate: a push publishes `sha-<12>` and `latest` manifests for both platforms,
@@ -27,7 +30,8 @@ Worker repository:
 
 - wire local inventory and metrics collector lifecycle into web server start
   and shutdown;
-- validate full HTTP config, including `WORKER_URL`, in main startup;
+- validate full HTTP config, including the accepted `PUBLIC_URL`, in main
+  startup;
 - [x] reconnect in memory on token rotation without stopping the runner;
 - [x] resend bounded check/notification results after websocket reconnect;
 - define process policy when the web listener exits unexpectedly;
@@ -70,7 +74,8 @@ Worker repository:
 - token handoff and revocation handling;
 - stale/expired signed-config behavior;
 - clear disabled/revoked UI state;
-- optional mTLS client identity.
+- mandatory production mTLS client identity and control-plane-owned topology as
+  defined in [public-endpoint-and-identity.md](public-endpoint-and-identity.md).
 
 Control-plane dependency:
 
@@ -139,13 +144,13 @@ State: Raft scaffold only.
 
 Worker repository:
 
-- secure bootstrap and mTLS identity;
+- secure bootstrap, CA lifecycle, mTLS identity, and one-origin HTTPS transport;
 - signed config adoption and observer-set versioning;
 - deterministic scheduler and check executor bridge;
 - deterministic incident/quorum FSM;
 - encrypted snapshots and restore;
 - metadata outbox, witness, replay, and metrics;
-- 3/5-node fault campaigns.
+- three-node external-HTTPS fault campaigns.
 
 Control-plane dependency: