fix(worker): harden control-plane lifecycle

- reconnect safely after token rotation and retry leased results
- reject malformed tasks and remove production cluster debug mutation
- validate environment files and require immutable container images

BREAKING CHANGE: Docker install, deploy, and Compose now require an
immutable repository@sha256 image reference.

docs/implementation-roadmap.md

@@ -28,12 +28,15 @@ Worker repository:
 - wire local inventory and metrics collector lifecycle into web server start
   and shutdown;
 - validate full HTTP config, including `WORKER_URL`, in main startup;
-- make token rotation reconnect rather than stop the runner;
+- [x] reconnect in memory on token rotation without stopping the runner;
+- [x] resend bounded check/notification results after websocket reconnect;
 - define process policy when the web listener exits unexpectedly;
-- add WebSocket reconnect, drain, duplicate frame, and backpressure tests.
+- add process-exit, bounded final-drain, duplicate-frame, and backpressure
+  coverage.
 
-Gate: collectors populate real pages, rotation preserves all subsystems, and
-SIGTERM leaves no listener, collector, task, or SQLite goroutine behind.
+Gate: collectors populate real pages, rotation preserves all subsystems, result
+resend remains bounded and idempotent, and SIGTERM leaves no listener,
+collector, task, or SQLite goroutine behind.
 
 ## R2: Protocol And Credential Hardening