feat(installer): build worker source over SSH

README.md

@@ -168,21 +168,52 @@ are rejected before connecting to the remote host.
 
 The default SSH port is 22 and the default RSMon URL is `https://rsmon.ru`.
 Encrypted keys use `--key-passphrase-file`; password authentication uses
-`--password-file`; password-protected sudo uses `--sudo-password-file`. Direct
-secret flags are supported for interactive convenience but file options are
-safer for automation.
+`--password-file`; password-protected sudo uses `--sudo-password-file`. Strongly
+prefer the file options for automation: a secret supplied through a direct flag
+is visible in the process list and shell history, while a file option never
+exposes it through argv. The direct flags remain available for interactive
+convenience.
 
 SSH host keys are checked against `~/.ssh/known_hosts` by default. Use
 `--known-hosts PATH` or pin `--host-key-fingerprint SHA256:...`. The explicit
 `--insecure-host-key` option disables host authentication and should only be
 used in a trusted disposable environment.
 
-A Go SSH source installer (remote package/toolchain/source build) is planned;
-the pure detection/planning layer and the Docker/OpenSSH test harness that will
-accept it are implemented. See
+A Go SSH source installer is implemented as the `source-install` subcommand: it
+detects the remote distro and architecture over the existing SSH transport,
+installs the minimal build prerequisites, downloads and SHA-256-verifies the
+pinned Go 1.26 toolchain, clones/updates the public repository, records the
+resolved branch and commit, and builds the worker to a staging path. It
+deliberately stops before touching the running service or its configuration
+(atomic activation and rollback are the next milestone). The pure
+detection/planning layer and the Docker/OpenSSH test harness that accepts it
+are implemented; see
 [`docs/source-installation.md`](docs/source-installation.md); run the live
 fixture matrix with `make test-ssh`.
 
+```bash
+./bin/rsmon-worker source-install \
+  --host worker.example.com \
+  --user deploy \
+  --identity-file ~/.ssh/id_ed25519
+```
+
+By default the installer builds the remote's default branch and records what it
+resolves to (the public repository currently publishes `master`). Pass
+`--branch <name>` to pin an explicit branch; it must exist on the remote or the
+install fails before building. The repository must be an `https://` URL without
+userinfo.
+
+The built binary is left at `/opt/rsmon-worker-src/rsmon-worker` (override with
+`--build-dir` / `--stage-binary`), the toolchain at `/usr/local/go` (replaced
+atomically: download, verify, stage, swap with rollback), and the resolved
+branch and commit in `/opt/rsmon-worker-src/rsmon-worker.commit` (written only
+after a successful build). The same SSH auth, secret-file, and host-key options
+as `deploy` apply; no worker token is sent because the source install does not
+configure a service. Prefer `--key-passphrase-file`, `--password-file`, and
+`--sudo-password-file` over their direct-flag equivalents: file options keep
+secrets out of the process list and shell history.
+
 ## Configuration
 
 | Variable | Required | Default | Purpose |