fix(worker): harden control-plane lifecycle

- reconnect safely after token rotation and retry leased results
- reject malformed tasks and remove production cluster debug mutation
- validate environment files and require immutable container images

BREAKING CHANGE: Docker install, deploy, and Compose now require an
immutable repository@sha256 image reference.

app/models/task_test.go

@@ -251,6 +251,7 @@ func TestTasksForWorker_SkipsLockedAndLeases(t *testing.T) {
 	for _, p := range picked {
 		assert.Equal(t, models.TaskStateLeased, p.State)
 		assert.Equal(t, w.WorkerID, p.LeaseOwner)
+		assert.NotEmpty(t, p.LeaseToken)
 		assert.NotNil(t, p.LeaseExpiresAt)
 		assert.Equal(t, 1, p.Attempts)
 	}