fix(worker): harden control-plane lifecycle

- reconnect safely after token rotation and retry leased results
- reject malformed tasks and remove production cluster debug mutation
- validate environment files and require immutable container images

BREAKING CHANGE: Docker install, deploy, and Compose now require an
immutable repository@sha256 image reference.

.env.example

@@ -2,6 +2,9 @@
 RSMON_URL=https://rsmon.ru
 RSMON_TOKEN=replace-with-worker-token
 
+# Required for Docker Compose. Replace with a published 64-character digest.
+RSMON_WORKER_IMAGE_DIGEST=replace-with-64-lowercase-hex-digest
+
 # Local operator console. Both credentials are required while the web UI is on.
 WORKER_HOST=0.0.0.0
 WORKER_PORT=27401