fix(worker): harden control-plane lifecycle

- reconnect safely after token rotation and retry leased results
- reject malformed tasks and remove production cluster debug mutation
- validate environment files and require immutable container images

BREAKING CHANGE: Docker install, deploy, and Compose now require an
immutable repository@sha256 image reference.

internal/webapp/server_test.go

@@ -88,40 +88,6 @@ func TestConfigFromEnvBasicAuthRejectsXOR(t *testing.T) {
 	assert.Error(t, err, "XOR (password only) must be rejected")
 }
 
-// TestConfigFromEnvDebugClusterApply pins the default-off behavior
-// of the cluster-apply debug gate and verifies the env flag flips
-// it on. Production builds must not accidentally expose the
-// endpoint, so the default is false.
-func TestConfigFromEnvDebugClusterApply(t *testing.T) {
-	cfg, err := ConfigFromEnv(map[string]string{}, t.TempDir())
-	require.NoError(t, err)
-	assert.False(t, cfg.DebugClusterApply, "default must leave the debug flag off")
-
-	cfg, err = ConfigFromEnv(map[string]string{
-		"WORKER_CLUSTER_DEBUG_APPLY": "true",
-	}, t.TempDir())
-	require.NoError(t, err)
-	assert.True(t, cfg.DebugClusterApply)
-
-	// Other truthy spellings accepted.
-	for _, v := range []string{"yes", "1", "TRUE", "YeS"} {
-		cfg, err = ConfigFromEnv(map[string]string{
-			"WORKER_CLUSTER_DEBUG_APPLY": v,
-		}, t.TempDir())
-		require.NoError(t, err)
-		assert.True(t, cfg.DebugClusterApply, "must accept truthy value %q", v)
-	}
-
-	// Empty / unknown values stay false.
-	for _, v := range []string{"", "false", "0", "no"} {
-		cfg, err = ConfigFromEnv(map[string]string{
-			"WORKER_CLUSTER_DEBUG_APPLY": v,
-		}, t.TempDir())
-		require.NoError(t, err)
-		assert.False(t, cfg.DebugClusterApply, "must reject non-truthy value %q", v)
-	}
-}
-
 // TestConfigFromEnvReleaseURL pins the env-driven WORKER_RELEASE_URL
 // plumbing. The handler reads cfg.ReleaseURL when the page renders,
 // so the value must survive ConfigFromEnv exactly.