fix(worker): harden control-plane lifecycle

- reconnect safely after token rotation and retry leased results
- reject malformed tasks and remove production cluster debug mutation
- validate environment files and require immutable container images

BREAKING CHANGE: Docker install, deploy, and Compose now require an
immutable repository@sha256 image reference.

README.md

@@ -37,8 +37,10 @@ docker compose up -d
 docker compose logs -f worker
 ```
 
-Compose pulls `reg.rsxx.ru/rsmon/rsmon-worker:latest` by default. Set
-`RSMON_WORKER_IMAGE` to use another published tag.
+Compose constructs an immutable image reference from
+`RSMON_WORKER_IMAGE_DIGEST`. Set that variable in `.env` to the published
+64-character lowercase digest before running Compose; a mutable tag cannot be
+selected through this configuration.
 
 The operator console is bound to `127.0.0.1:27401` by default. Set
 `WORKER_BIND_IP` only when a firewall or TLS reverse proxy protects the port.
@@ -47,21 +49,27 @@ Persistent web and cluster state is stored in the `worker-data` volume.
 ## Docker
 
 ```bash
-docker pull reg.rsxx.ru/rsmon/rsmon-worker:latest
+IMAGE='reg.rsxx.ru/rsmon/rsmon-worker@sha256:<published-64-character-digest>'
+docker pull "$IMAGE"
 docker run --rm \
   --cap-add NET_RAW \
   --env-file .env \
   -p 127.0.0.1:27401:27401 \
   -v rsmon-worker-data:/var/lib/rsmon-worker \
-  reg.rsxx.ru/rsmon/rsmon-worker:latest
+  "$IMAGE"
 ```
 
-Published images use these tags:
+Published images have tags for discovery:
 
 - `sha-<12-character-commit>` for every push;
 - `latest` for `master`;
 - the `v*` release ref, with Docker-invalid characters replaced by `-`.
 
+Resolve a trusted published tag through the registry, then deploy the resulting
+`repository@sha256:...` digest. Tags are mutable and are not accepted by the
+installer or deploy command; Compose requires the resolved digest to be
+configured explicitly.
+
 The Gitea workflow reads `HARBOR_REGISTRY`, `HARBOR_USER`, and
 `HARBOR_PASSWORD`. `HARBOR_REGISTRY` may be a host such as `reg.rsxx.ru` or an
 HTTP(S) URL; the workflow strips the scheme and trailing slash before composing
@@ -91,17 +99,24 @@ rm worker-token
 mode-0600 configuration at `/etc/rsmon-worker/worker.env`, installs a simple
 root-run systemd unit, and enables and starts it. Use `--url` to override
 `https://rsmon.ru`, `--binary` to install another binary, or `--no-start` to
-configure without starting.
+configure without starting. When using `--env-file`, installation verifies its
+`RSMON_URL` and `RSMON_TOKEN` before changing the host. Environment files use
+portable `KEY=VALUE` lines (plus blank lines and `#` comments); quoting,
+interpolation, whitespace in values, and YAML-style assignments are rejected
+because systemd and Docker interpret them differently.
 
 The Docker alternative pulls the prebuilt image and installs a systemd unit
 that runs it:
 
 ```bash
-sudo ./bin/rsmon-worker install --docker --token-file worker-token
+sudo ./bin/rsmon-worker install --docker --token-file worker-token \
+  --image 'reg.rsxx.ru/rsmon/rsmon-worker@sha256:<published-64-character-digest>'
 ```
 
-The image defaults to `reg.rsxx.ru/rsmon/rsmon-worker:latest`; override it with
-`--image`.
+Docker installation requires `--image` with an immutable
+`repository@sha256:<64-lowercase-hex-characters>` reference. This is a breaking
+change: prior `--docker` invocations that relied on the `latest` default, or
+passed only a tag, now fail before Docker is invoked or any host file is changed.
 
 The token can also be passed as `--token` or `--api-key`, but that can expose it
 through shell history and process inspection. The legacy repository-based
@@ -141,7 +156,8 @@ sudo access.
 Add `--docker` to install remotely by uploading only the configuration and
 systemd unit, then running `docker pull` on the target. This mode does not upload
 or execute the local worker binary, so the local and remote architectures may
-differ.
+differ. It also requires `--image repository@sha256:...`; tag-only references
+are rejected before connecting to the remote host.
 
 The default SSH port is 22 and the default RSMon URL is `https://rsmon.ru`.
 Encrypted keys use `--key-passphrase-file`; password authentication uses