fix(worker): harden control-plane lifecycle

- reconnect safely after token rotation and retry leased results
- reject malformed tasks and remove production cluster debug mutation
- validate environment files and require immutable container images

BREAKING CHANGE: Docker install, deploy, and Compose now require an
immutable repository@sha256 image reference.

docs/critical-check-cluster.md

@@ -11,8 +11,10 @@ It does not yet execute `distributed_critical` checks, verify signed config,
 evaluate observation/region/notification quorum, encrypt snapshots, deliver a
 commit-backed outbox, or consume an external witness report.
 
-The hardcoded test-config endpoint and startup flag are development-only and
-must stay disabled in production.
+The former hardcoded test-config endpoint, startup flag, environment switch,
+and production helper have been removed. Hardcoded config application now
+exists only as an unexported `_test.go` helper and is absent from production
+builds.
 
 ## Non-Negotiable Separation
 
@@ -163,16 +165,16 @@ but cannot commit or fabricate incidents.
 
 ## Ordered Implementation
 
-1. Remove production exposure of debug config application.
-2. Complete versioned FSM types, command validation, and deterministic tests.
-3. Add mTLS identity and safe one-claim cluster bootstrap.
-4. Add signed config and observer-set adoption.
-5. Add deterministic scheduler and checkexec bridge in shadow mode.
-6. Implement observation aggregation, incident policy, and idempotency.
-7. Implement encrypted snapshots and restore/migration tests.
-8. Add metadata outbox executor and failover-safe delivery.
-9. Add external witness, replay, metrics, and operational runbooks.
-10. Run synthetic 3/5-node fault campaigns before any customer check.
+1. [x] Remove production exposure of debug config application.
+2. [ ] Complete versioned FSM types, command validation, and deterministic tests.
+3. [ ] Add mTLS identity and safe one-claim cluster bootstrap.
+4. [ ] Add signed config and observer-set adoption.
+5. [ ] Add deterministic scheduler and checkexec bridge in shadow mode.
+6. [ ] Implement observation aggregation, incident policy, and idempotency.
+7. [ ] Implement encrypted snapshots and restore/migration tests.
+8. [ ] Add metadata outbox executor and failover-safe delivery.
+9. [ ] Add external witness, replay, metrics, and operational runbooks.
+10. [ ] Run synthetic 3/5-node fault campaigns before any customer check.
 
 ## Release Gates