fix(worker): harden control-plane lifecycle

- reconnect safely after token rotation and retry leased results
- reject malformed tasks and remove production cluster debug mutation
- validate environment files and require immutable container images

BREAKING CHANGE: Docker install, deploy, and Compose now require an
immutable repository@sha256 image reference.

internal/checkexec/exec.go

@@ -27,6 +27,16 @@ type ExecutedCheck struct {
 	Metrics []wire.MetricPoint
 }
 
+// SupportsKind reports whether Execute has a local executor for kind.
+func SupportsKind(kind string) bool {
+	switch kind {
+	case "http", "ssl", "ssh", "ftp", "dns", "whois", "bssl", "llm", "llm-http", "ping", "tcp", "udp":
+		return true
+	default:
+		return false
+	}
+}
+
 // Execute runs checks without saving to DB or InfluxDB.
 // Results are returned for reporting via API to the control plane.
 // This is designed for distributed workers that have no direct DB access.
@@ -35,6 +45,9 @@ func Execute(m *models.Monitor, checks []models.Check) []ExecutedCheck {
 	for i := range checks {
 		c := &checks[i]
 		c.Monitor = m
+		if !SupportsKind(c.Kind) {
+			continue
+		}
 		switch c.Kind {
 		case "http":
 			r := chttp.Perform(c)

internal/checkexec/exec_test.go

@@ -0,0 +1,16 @@
+package checkexec
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestSupportsKindMatchesExecuteDispatch(t *testing.T) {
+	for _, kind := range []string{"http", "ssl", "ssh", "ftp", "dns", "whois", "bssl", "llm", "llm-http", "ping", "tcp", "udp"} {
+		assert.Truef(t, SupportsKind(kind), "kind %q", kind)
+	}
+	for _, kind := range []string{"", "rkn", "smtp"} {
+		assert.Falsef(t, SupportsKind(kind), "kind %q", kind)
+	}
+}