fix(worker): harden control-plane lifecycle

- reconnect safely after token rotation and retry leased results
- reject malformed tasks and remove production cluster debug mutation
- validate environment files and require immutable container images

BREAKING CHANGE: Docker install, deploy, and Compose now require an
immutable repository@sha256 image reference.

cmd/rsmon-worker/main_test.go

@@ -1,9 +1,13 @@
 package main
 
 import (
+	"errors"
 	"net/http"
 	"net/http/httptest"
 	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
 	"testing"
 )
 
@@ -52,3 +56,23 @@ func TestProbeLiveness(t *testing.T) {
 		})
 	}
 }
+
+func TestRemovedClusterDebugApplyTestConfigFlagIsRejected(t *testing.T) {
+	binary := filepath.Join(t.TempDir(), "rsmon-worker")
+	build := exec.Command("go", "build", "-o", binary, ".")
+	if output, err := build.CombinedOutput(); err != nil {
+		t.Fatalf("build worker binary: %v\n%s", err, output)
+	}
+
+	output, err := exec.Command(binary, "--cluster-debug-apply-test-config").CombinedOutput()
+	var exitErr *exec.ExitError
+	if !errors.As(err, &exitErr) {
+		t.Fatalf("removed flag error = %v, want parser exit\n%s", err, output)
+	}
+	if exitErr.ExitCode() != 2 {
+		t.Fatalf("removed flag exit code = %d, want 2\n%s", exitErr.ExitCode(), output)
+	}
+	if !strings.Contains(string(output), "flag provided but not defined: -cluster-debug-apply-test-config") {
+		t.Fatalf("removed flag output = %q, want undefined-flag error", output)
+	}
+}