fix(worker): harden control-plane lifecycle

- reconnect safely after token rotation and retry leased results
- reject malformed tasks and remove production cluster debug mutation
- validate environment files and require immutable container images

BREAKING CHANGE: Docker install, deploy, and Compose now require an
immutable repository@sha256 image reference.

internal/webapp/handlers_updates_test.go

@@ -224,7 +224,10 @@ func TestChecksPage_RunNowDisabledButton(t *testing.T) {
 // TestNotificationsPage_ResendDisabledButton mirrors the checks
 // page test for the resend button on /notifications.
 func TestNotificationsPage_ResendDisabledButton(t *testing.T) {
-	srv := newTestServer(t, &stubRunner{id: "w-1"})
+	srv := newTestServer(t, &stubRunner{id: "w-1", notifs: []NotificationRow{
+		{Kind: "email", Channel: "smtp", Subject: "selfcheck", Body: "main API down", OK: true, At: time.Now()},
+		{JobID: "delegated-job", Method: "sms", Status: "permanent", DurationMs: 12, At: time.Now()},
+	}})
 	ts := newHTTPTestServer(t, srv)
 	c, _ := loginAsFirstRun(t, ts.URL, srv)
 	clearRequiresChange(t, srv)
@@ -239,6 +242,11 @@ func TestNotificationsPage_ResendDisabledButton(t *testing.T) {
 	assert.Contains(t, page, "Resend")
 	assert.Contains(t, page, "disabled")
 	assert.Contains(t, page, "worker-notifier-mvp")
+	assert.Contains(t, page, "selfcheck")
+	assert.Contains(t, page, "delegated-job")
+	assert.Contains(t, page, "sms")
+	assert.Contains(t, page, "permanent")
+	assert.Contains(t, page, "12 ms")
 }
 
 // TestAppsPage_ReferencesInventoryPlan ensures the copy on