fix(worker): harden control-plane lifecycle

- reconnect safely after token rotation and retry leased results
- reject malformed tasks and remove production cluster debug mutation
- validate environment files and require immutable container images

BREAKING CHANGE: Docker install, deploy, and Compose now require an
immutable repository@sha256 image reference.

internal/distworker/server_metrics.go

@@ -1,6 +1,7 @@
 package distworker
 
 import (
+	"context"
 	"os"
 	"path/filepath"
 	"sort"
@@ -35,32 +36,41 @@ const (
 // the real Linux /proc and statfs collector; unsupported platforms return no
 // report rather than fabricated values. The worker has no control-plane DB
 // access and forwards snapshots on its authenticated websocket.
-func (r *Runner) serverMetricLoop() {
+func (r *Runner) serverMetricLoop(ctx context.Context) {
 	ticker := time.NewTicker(serverMetricInterval)
 	defer ticker.Stop()
 	for {
 		select {
-		case <-r.stopCh:
+		case <-ctx.Done():
 			return
 		case <-ticker.C:
 			serverID := r.serverID.Load()
-			if serverID == 0 || r.metricResults == nil {
+			if serverID == 0 {
 				continue
 			}
 			report, ok := collectServerMetric(serverID)
 			if !ok {
 				continue
 			}
-			select {
-			case r.metricResults <- report:
-			case <-r.stopCh:
-				return
-			default:
-			}
+			r.enqueueMetric(report)
 		}
 	}
 }
 
+func (r *Runner) enqueueMetric(report wire.ServerMetricReport) {
+	if r.metricResults == nil {
+		return
+	}
+	generation := r.metricGeneration.Load()
+	if generation == 0 || r.metricGeneration.Load() != generation {
+		return
+	}
+	select {
+	case r.metricResults <- metricEnvelope{generation: generation, report: report}:
+	default:
+	}
+}
+
 func collectServerMetric(serverID int64) (wire.ServerMetricReport, bool) {
 	memTotal, memAvailable, load1, load5, load15, uptime, ok := readLinuxHostMetrics("/proc")
 	if !ok {