fix(worker): harden control-plane lifecycle

- reconnect safely after token rotation and retry leased results
- reject malformed tasks and remove production cluster debug mutation
- validate environment files and require immutable container images

BREAKING CHANGE: Docker install, deploy, and Compose now require an
immutable repository@sha256 image reference.

internal/webapp/handlers_cluster.go

@@ -74,63 +74,6 @@ func (s *Server) handleClusterStatus(w http.ResponseWriter, _ *http.Request) {
 	}
 }
 
-// handleClusterApplyTestConfig applies a hardcoded config.adopt log
-// entry to the cluster. It exists so the e2e script and any operator
-// debugging session can verify FSM replication without having to wire
-// up the real signed-config-adoption producer (which lives in a later
-// phase).
-//
-// DEBUG: this endpoint is a placeholder for the real producer. It must
-// be replaced (or removed) before any production deployment.
-//
-// The handler is gated behind Config.DebugClusterApply (env
-// WORKER_CLUSTER_DEBUG_APPLY=true). When the flag is false the
-// handler returns 404 — the route is still registered so the auth
-// + CSRF paths are exercised in tests, but no real FSM entry is ever
-// appended from a production webapp.
-//
-// TODO(worker-cluster-real-producer): remove the apply-test-config
-// endpoint entirely once the signed-config-adoption producer ships.
-func (s *Server) handleClusterApplyTestConfig(w http.ResponseWriter, r *http.Request) {
-	writeNoStore(w)
-	if !s.cfg.DebugClusterApply {
-		http.NotFound(w, r)
-		return
-	}
-	if s.cluster == nil {
-		http.Error(w, "cluster not configured", http.StatusServiceUnavailable)
-		return
-	}
-	if !s.requireCSRF(sessionFromContextOrFail(w, r), r) {
-		http.Error(w, "csrf token required", http.StatusForbidden)
-		return
-	}
-	applied, err := s.cluster.ApplyTestConfig()
-	if err != nil {
-		s.deps.Logger.Printf("cluster apply test config: %v", err)
-		http.Error(w, err.Error(), http.StatusBadGateway)
-		return
-	}
-	w.Header().Set("Content-Type", "application/json; charset=utf-8")
-	w.WriteHeader(http.StatusOK)
-	if err := json.NewEncoder(w).Encode(map[string]uint64{"applied_index": applied}); err != nil {
-		s.deps.Logger.Printf("cluster apply encode: %v", err)
-	}
-}
-
-// sessionFromContextOrFail is a tiny adapter so requireCSRF can be
-// called from this handler without leaking the middleware into the
-// cluster package. If no session is attached (should not happen
-// because requireSession already ran) we return a stub session with
-// no CSRF token, which causes requireCSRF to refuse the request.
-func sessionFromContextOrFail(_ http.ResponseWriter, r *http.Request) *Session {
-	sess, _ := sessionFromContext(r.Context())
-	if sess != nil {
-		return sess
-	}
-	return &Session{}
-}
-
 // ErrClusterNotConfigured is returned when a cluster-admin endpoint is
 // hit on a server without a cluster attached.
 var ErrClusterNotConfigured = errors.New("webapp: cluster not configured")