feat(installer): build worker source over SSH

docs/implementation-roadmap.md

@@ -15,8 +15,8 @@ Worker repository:
   metadata;
 - add a package/install smoke test for Docker and systemd artifacts;
 - add the Docker/OpenSSH source-install matrix for Alpine, Ubuntu, and Arch from
-  [source-installation.md](source-installation.md), using Go 1.26 and branch
-  `main`;
+  [source-installation.md](source-installation.md), using Go 1.26 and the
+  remote default branch;
 - document immutable SHA and release tags as production defaults.
 
 Source-install foundations landed:
@@ -26,9 +26,16 @@ Source-install foundations landed:
       reliable teardown, gated behind `RSMON_TEST_DOCKER` (`make test-ssh`);
 - [x] pure distro/toolchain/source-install planning (`internal/sshinstall`):
       os-release detection, package-manager/init resolution, pinned Go 1.26
-      toolchain with published SHA-256, and a plan the executor will run;
-- [ ] remote package install, Go download, clone, and build execution through
-      the SSH transport (source-install work package 3);
+      toolchain with published SHA-256, and a plan the executor runs;
+- [x] remote package install, Go download, clone, and build execution through
+      the SSH transport (`installer.SourceInstall`): prerequisite install,
+      SHA-256-verified Go toolchain, clone/update of the public repo, resolved
+      branch/commit record, and a staging build. Running service/config is not
+      touched (source-install work package 3);
+- [ ] atomic service activation, rollback, and failure-preservation tests over
+      SSH (source-install work package 4);
+- [ ] run the full source-install E2E matrix in CI (source-install work
+      package 5).
 
 Gate: a push publishes `sha-<12>` and `latest` manifests for both platforms,
 and a container remains healthy when the control plane is unavailable.