feat(worker): adopt canonical public URL

docs/install.md

@@ -33,8 +33,8 @@ sudo apt-get install -y ca-certificates chromium libcap2-bin tzdata
 The installer reads the same environment variables the worker runtime reads.
 Each variable is resolved with this precedence (highest first):
 
-1. **Explicit flags** (`--url`, `--token`, `--host`, `--port`, `--login`,
-   `--password`, `--name`).
+1. **Explicit flags** (`--url`, `--public-url`, `--token`, `--host`, `--port`,
+   `--login`, `--password`, `--name`).
 2. **`--env-file`** — a strict, systemd-safe `KEY=VALUE` file (validated before
    anything is written to disk).
 3. **Process environment**, including a `.env` file in the working directory
@@ -54,7 +54,7 @@ values automatically. To override a value, pass the matching flag.
 | `RSMON_TOKEN` | yes | none | Worker bearer token. |
 | `WORKER_HOST` | no | `127.0.0.1` | Operator-console bind address. |
 | `WORKER_PORT` | no | `27401` (primary) | Operator-console port. **Required** for named instances. |
-| `PUBLIC_URL` | no | none | Proposed public HTTPS origin; accepted by the control plane. |
+| `PUBLIC_URL` | no | none | Advertised public origin: absolute http(s) URL with scheme and authority only (no userinfo, query, fragment, or path). Canonical name; `WORKER_URL` is a deprecated legacy alias read only during the bounded migration. |
 | `WORKER_LOGIN` | no | `admin` (generated) | Operator-console basic-auth login. |
 | `WORKER_PASSWORD` | no | generated | Operator-console basic-auth password. |
 | `WORKER_COMPOSE_ENABLED` | no | feature default (on) | Enable Docker Compose discovery/management. |
@@ -69,8 +69,19 @@ endpoints.
 
 `PUBLIC_URL` does not bind a listener or terminate TLS. It advertises the one
 external origin used for the console, authenticated peer status, and planned
-Raft `/raft` transport. See
-[public-endpoint-and-identity.md](public-endpoint-and-identity.md).
+Raft `/raft` transport. It must be an absolute `http`/`https` URL with a scheme
+and authority and nothing else; a path (other than `/`), userinfo, query, or
+fragment is rejected at install time and at worker startup. `PUBLIC_URL` is the
+canonical variable; the legacy `WORKER_URL` is still accepted for the bounded
+migration defined in
+[public-endpoint-and-identity.md](public-endpoint-and-identity.md), and is
+dropped from a freshly written env file whenever `PUBLIC_URL` is also set.
+The legacy `WORKER_URL` is held only to the tolerant absolute-URL check, so
+shapes that previously installed keep working. In an explicitly production
+environment (`DEPLOY_ENV=production`, or `RSMON_ENV`/`GO_ENV=production`) a
+plain-HTTP `PUBLIC_URL` on a non-loopback host is rejected at startup; a legacy
+`WORKER_URL` keeps the historical warn-only behavior. Both variables reject a
+missing hostname, e.g. `https://:27401`.
 
 Values must be systemd-safe: no whitespace, quotes, backslashes, or `$`
 interpolation inside a value. This keeps the file unambiguous across systemd
@@ -208,6 +219,7 @@ rsmon-worker install [--token TOKEN|--token-file FILE|--env-file FILE]
 | `--token-file` | File containing the worker token (avoids shell history). |
 | `--env-file` | Strict worker env file; validated then used as the config source. |
 | `--url` | Control-plane URL (`RSMON_URL`). |
+| `--public-url` | Advertised public origin (`PUBLIC_URL`; scheme + host, no path). |
 | `--host` | Console bind address (`WORKER_HOST`). |
 | `--port` | Console port (`WORKER_PORT`; required with `--name`). |
 | `--login` | Console login (`WORKER_LOGIN`). |