fix(worker): harden control-plane lifecycle

- reconnect safely after token rotation and retry leased results
- reject malformed tasks and remove production cluster debug mutation
- validate environment files and require immutable container images

BREAKING CHANGE: Docker install, deploy, and Compose now require an
immutable repository@sha256 image reference.

internal/distworker/results.go

@@ -14,10 +14,7 @@ import (
 const recentResultsSize = 200
 
 // recentNotificationsSize mirrors recentResultsSize for emitted
-// notifications. Phase 1 only writes selfcheck alerts to this
-// buffer (the main app's notification flow still lives in the main
-// app); the buffer is shape-stable so future phases can append
-// without changing the page contract.
+// notifications.
 const recentNotificationsSize = 100
 
 // ResultRow is one row from the worker's in-memory result ring
@@ -35,9 +32,9 @@ type ResultRow struct {
 	At         time.Time
 }
 
-// NotificationRow is one row from the worker's notification ring
-// buffer. Phase 1 only fills this from selfcheck alerts; the row
-// shape is forward-compatible with main-app-issued notifications.
+// NotificationRow is one row from the worker's notification ring buffer.
+// Delegated rows use only JobID, Method, Status, DurationMs, and At. They
+// deliberately omit delivery inputs and provider output.
 type NotificationRow struct {
 	Kind    string // "email", "telegram_private", "telegram_group"
 	Channel string
@@ -46,6 +43,11 @@ type NotificationRow struct {
 	OK      bool
 	Error   string
 	At      time.Time
+
+	JobID      string
+	Method     string
+	Status     string
+	DurationMs int
 }
 
 // resultBuffer is a thread-safe FIFO ring buffer of ResultRow. The