fix(worker): harden control-plane lifecycle

- reconnect safely after token rotation and retry leased results
- reject malformed tasks and remove production cluster debug mutation
- validate environment files and require immutable container images

BREAKING CHANGE: Docker install, deploy, and Compose now require an
immutable repository@sha256 image reference.

cmd/rsmon-worker/management.go

@@ -36,7 +36,7 @@ func installCommand(args []string) int {
 	fs.StringVar(&tokenFile, "token-file", "", "file containing the worker API token")
 	fs.StringVar(&opts.URL, "url", installer.DefaultURL, "RSMon server URL")
 	fs.BoolVar(&opts.Docker, "docker", false, "run the prebuilt Docker image instead of the binary")
-	fs.StringVar(&opts.Image, "image", installer.DefaultImage, "Docker image used with --docker")
+	fs.StringVar(&opts.Image, "image", installer.DefaultImage, "immutable Docker repository@sha256 digest required with --docker")
 	fs.BoolVar(&opts.NoStart, "no-start", false, "install and enable without starting")
 	fs.Usage = func() {
 		fmt.Fprintln(fs.Output(), "Usage: rsmon-worker install --token TOKEN [--url URL] [--no-start]")
@@ -89,7 +89,7 @@ func deployCommand(args []string) int {
 	fs.StringVar(&tokenFile, "token-file", "", "file containing the worker API token")
 	fs.StringVar(&opts.URL, "url", installer.DefaultURL, "RSMon server URL")
 	fs.BoolVar(&opts.Docker, "docker", false, "install the prebuilt Docker image remotely")
-	fs.StringVar(&opts.Image, "image", installer.DefaultImage, "Docker image used with --docker")
+	fs.StringVar(&opts.Image, "image", installer.DefaultImage, "immutable Docker repository@sha256 digest required with --docker")
 	fs.BoolVar(&opts.NoStart, "no-start", false, "install and enable without starting")
 	fs.Usage = func() {
 		fmt.Fprintln(fs.Output(), "Usage: rsmon-worker deploy --host HOST --user USER --token TOKEN [SSH options]")