fix(worker): harden control-plane lifecycle

- reconnect safely after token rotation and retry leased results
- reject malformed tasks and remove production cluster debug mutation
- validate environment files and require immutable container images

BREAKING CHANGE: Docker install, deploy, and Compose now require an
immutable repository@sha256 image reference.

docs/sessions/2026-07-19-standalone-deployment.md

@@ -29,8 +29,9 @@ default and offer the prebuilt Docker image as an explicit alternative.
 
 - The default service uses `Type=simple`, runs as `root`, and restarts only on
   failure.
-- Docker deployment pulls `reg.rsxx.ru/rsmon/rsmon-worker:latest` on the target
-  host instead of uploading a local image or binary.
+- Docker deployment pulls an explicitly selected immutable image digest on the
+  target host instead of uploading a local image or binary. The original
+  mutable `latest` default was superseded by a supply-chain hardening change.
 - The existing source-available license remains unchanged until public-release
   licensing is decided.
 - Worker credentials are supplied at deployment time and are not stored in the