fix(worker): harden control-plane lifecycle

- reconnect safely after token rotation and retry leased results
- reject malformed tasks and remove production cluster debug mutation
- validate environment files and require immutable container images

BREAKING CHANGE: Docker install, deploy, and Compose now require an
immutable repository@sha256 image reference.

internal/webapp/routes.go

@@ -62,7 +62,6 @@ func (s *Server) routes() {
 	// Both routes require a session (the worker webapp is single-tenant
 	// so every logged-in operator is effectively an admin).
 	s.mux.Handle("GET /web/api/cluster/status", s.requireSession(s.handleClusterStatus))
-	s.mux.Handle("POST /web/api/cluster/apply-test-config", s.requireSession(s.handleClusterApplyTestConfig))
 
 	// Cross-worker peer status. The path is intentionally under
 	// /api/ (not /web/api/) so the basic-auth middleware does not