fix(worker): harden control-plane lifecycle

- reconnect safely after token rotation and retry leased results
- reject malformed tasks and remove production cluster debug mutation
- validate environment files and require immutable container images

BREAKING CHANGE: Docker install, deploy, and Compose now require an
immutable repository@sha256 image reference.

internal/webapp/templates/notifications.html

@@ -1,15 +1,15 @@
 {{define "body"}}<section class="card">
   <h1>Recent notifications</h1>
-  <p class="muted">Last 50 notifications emitted by this worker (Phase 1: selfcheck alerts only).</p>
+  <p class="muted">Last 50 notification attempts emitted by this worker.</p>
   <p><button type="button" disabled title="{{.ResendTooltip}}">Resend selected</button>
      <span class="muted">{{.ResendTooltip}}</span></p>
   <table>
     <thead>
       <tr>
-        <th>Channel</th>
-        <th>Subject</th>
-        <th>Body</th>
+        <th>Type</th>
+        <th>Details</th>
         <th>Status</th>
+        <th>Duration</th>
         <th>Error</th>
         <th>When</th>
       </tr>
@@ -17,15 +17,23 @@
     <tbody>
       {{range .Rows}}
       <tr>
-        <td>{{.Channel}} ({{.Kind}})</td>
-        <td>{{.Subject}}</td>
-        <td><code>{{.Body}}</code></td>
+        {{if .JobID}}
+        <td>delegated</td>
+        <td>job <code>{{.JobID}}</code>, {{.Method}}</td>
+        <td>{{.Status}}</td>
+        <td>{{.DurationMs}} ms</td>
+        <td></td>
+        {{else}}
+        <td>selfcheck</td>
+        <td>{{.Channel}} ({{.Kind}}): {{.Subject}} <code>{{.Body}}</code></td>
         <td>{{if .OK}}<span class="ok">delivered</span>{{else}}<span class="error">failed</span>{{end}}</td>
+        <td>-</td>
         <td>{{.Error}}</td>
+        {{end}}
         <td>{{fmtTime .At}}</td>
       </tr>
       {{else}}
-      <tr><td colspan="6" class="muted">No notifications yet.</td></tr>
+        <tr><td colspan="6" class="muted">No notifications yet.</td></tr>
       {{end}}
     </tbody>
   </table>