fix(worker): harden control-plane lifecycle

- reconnect safely after token rotation and retry leased results
- reject malformed tasks and remove production cluster debug mutation
- validate environment files and require immutable container images

BREAKING CHANGE: Docker install, deploy, and Compose now require an
immutable repository@sha256 image reference.

docs/changelog.md

@@ -11,9 +11,10 @@
   through `known_hosts` or a pinned fingerprint.
 - Added `--token-file`, `--url`, `--api-key`, and `--no-start` deployment
   options.
-- Added optional `--docker` deployment using the prebuilt
-  `reg.rsxx.ru/rsmon/rsmon-worker:latest` image. Remote Docker deployment pulls
-  the image on the target host and does not depend on the local architecture.
+- Added optional `--docker` deployment using a prebuilt image. Docker install
+  and deploy now require an immutable `repository@sha256:...` reference before
+  any Docker or remote-host mutation; the former mutable `latest` default is no
+  longer accepted.
 - Simplified the default systemd service to `Type=simple`, `User=root`, and
   `Restart=on-failure`.
 - Reworked the legacy `scripts/install-systemd.sh` script as a compatibility
@@ -34,3 +35,27 @@
   execution, and production worker job reporting.
 - Published the changes as commit `3256dcd` (`feat: add worker install and
   deploy`) on `master`, triggering the Docker image workflow.
+
+### Task protocol and local audit hardening
+
+- Required one task-envelope branch, matching outer/inner job IDs, and a
+  non-empty lease token before local execution.
+- Added structured terminal failures for unsupported check kinds and safely
+  attributable malformed envelopes.
+- Recorded delegated notification outcomes in the bounded `/notifications`
+  view using only job ID, method, status, duration, and time.
+- Added static permanent handling for invalid deadlines and recovered
+  notification executor panics without retaining secret-bearing text.
+- Removed the critical-cluster test-config endpoint, CLI flag, environment
+  switch, and production helper; hardcoded config application is test-only.
+- Made runner token rotation connection-scoped and in-memory: it reconnects
+  without stopping web, inventory, metrics, or cluster subsystems. Durable token
+  storage, bootstrap exchange, rotation acknowledgement, and revocation remain
+  unimplemented.
+- Added bounded resend of dequeued check and notification result envelopes after
+  websocket reconnect; control-plane application remains at-least-once and must
+  deduplicate by leased job and lease token. Failed metric snapshots are dropped
+  and replaced by the next periodic tick, not replayed.
+- SIGTERM stops new dispatch and waits for active work, but stale-lease
+  acknowledgement, bounded graceful final-result drain, and duplicate-frame
+  coverage remain open.