fix(worker): harden control-plane lifecycle

- reconnect safely after token rotation and retry leased results
- reject malformed tasks and remove production cluster debug mutation
- validate environment files and require immutable container images

BREAKING CHANGE: Docker install, deploy, and Compose now require an
immutable repository@sha256 image reference.

internal/distworker/notification.go

@@ -25,14 +25,27 @@ import (
 // silently dropping it as the production plan forbids).
 //
 //nolint:gocritic // task model is shared with the rest of the dispatcher; keep by-value
-func (r *Runner) ExecuteNotification(ctx context.Context, task models.Task) wire.NotificationResultReport {
+func (r *Runner) ExecuteNotification(ctx context.Context, task models.Task) (report wire.NotificationResultReport) {
 	start := time.Now()
-
-	report := wire.NotificationResultReport{
+	method := ""
+	report = wire.NotificationResultReport{
 		JobID:      task.JobID,
 		Status:     wire.NotificationResultPermanent,
 		DurationMs: 0,
 	}
+	defer func() {
+		if recover() != nil {
+			report.Status = wire.NotificationResultPermanent
+			report.ProviderResponse = nil
+			report.RetryAfterSeconds = nil
+			report.Error = stringPtr("notification executor panic")
+		}
+		report.DurationMs = int(time.Since(start) / time.Millisecond)
+		r.recordDelegatedNotification(report.JobID, method, report)
+	}()
+	if r.notificationExecutor != nil {
+		return r.notificationExecutor(ctx, task)
+	}
 
 	if len(task.Payload) == 0 {
 		report.Status = wire.NotificationResultPermanent
@@ -50,6 +63,7 @@ func (r *Runner) ExecuteNotification(ctx context.Context, task models.Task) wire
 	if nt.JobID == "" {
 		nt.JobID = task.JobID
 	}
+	method = nt.Method
 	if nt.MessageID == 0 && task.MessageID != nil {
 		nt.MessageID = *task.MessageID
 	}