fix(worker): harden control-plane lifecycle

- reconnect safely after token rotation and retry leased results
- reject malformed tasks and remove production cluster debug mutation
- validate environment files and require immutable container images

BREAKING CHANGE: Docker install, deploy, and Compose now require an
immutable repository@sha256 image reference.

internal/webapp/constants.go

@@ -24,14 +24,13 @@ const (
 // Environment variable names referenced by ConfigFromEnv. Lifted out
 // so the validator and the cmd binary share the same constants.
 const (
-	envWorkerHost        = "WORKER_HOST"
-	envWorkerPort        = "WORKER_PORT"
-	envWorkerURL         = "WORKER_URL"
-	envWorkerLogin       = "WORKER_LOGIN"
-	envWorkerPassword    = "WORKER_PASSWORD"
-	envClusterEnabled    = "WORKER_CLUSTER_ENABLED"
-	envClusterDebugApply = "WORKER_CLUSTER_DEBUG_APPLY"
-	envReleaseURL        = "WORKER_RELEASE_URL"
+	envWorkerHost     = "WORKER_HOST"
+	envWorkerPort     = "WORKER_PORT"
+	envWorkerURL      = "WORKER_URL"
+	envWorkerLogin    = "WORKER_LOGIN"
+	envWorkerPassword = "WORKER_PASSWORD"
+	envClusterEnabled = "WORKER_CLUSTER_ENABLED"
+	envReleaseURL     = "WORKER_RELEASE_URL"
 )
 
 // Route paths used as redirect targets. Lifted out so goconst stops