fix(worker): harden control-plane lifecycle

- reconnect safely after token rotation and retry leased results
- reject malformed tasks and remove production cluster debug mutation
- validate environment files and require immutable container images

BREAKING CHANGE: Docker install, deploy, and Compose now require an
immutable repository@sha256 image reference.

internal/workercluster/admin_test.go

@@ -72,11 +72,9 @@ func TestClusterSmokeStats(t *testing.T) {
 	assert.Equal(t, addr, c.LocalAddr())
 }
 
-// TestClusterApplyTestConfig_Smoke verifies the ApplyTestConfig helper
-// commits a config.adopt entry and the FSM reflects the new version.
-// This is the function the webapp admin endpoint and the CLI flag
-// both go through.
-func TestClusterApplyTestConfig_Smoke(t *testing.T) {
+// TestClusterTestConfig_Smoke verifies the test-only helper commits a
+// config.adopt entry and the FSM reflects the new version.
+func TestClusterTestConfig_Smoke(t *testing.T) {
 	addr := pickPort(t)
 	dataDir := t.TempDir()
 	creds := HTTPCreds{Login: "alice", Password: "secret"}
@@ -108,8 +106,8 @@ func TestClusterApplyTestConfig_Smoke(t *testing.T) {
 	require.Equal(t, raft.Leader, c.Raft().State(),
 		"smoke test requires the local node to be leader")
 
-	check := DefaultDebugCriticalCheck()
-	idx, err := c.ApplyTestConfig(&check)
+	check := defaultTestCriticalCheck()
+	idx, err := c.applyTestConfig(&check)
 	require.NoError(t, err)
 	assert.NotZero(t, idx, "applied index must be non-zero")
 
@@ -164,11 +162,11 @@ func TestClusterStats_FSMFieldsOnFreshCluster(t *testing.T) {
 		"newly created FSM defaults Partition.State to 'steady'")
 }
 
-// TestApplyTestConfig_NonLeaderErrors pins the precondition that the
+// TestTestConfig_NonLeaderErrors pins the precondition that the
 // helper refuses to submit an entry on a non-leader (the raft library
 // would reject the apply anyway, but we want the failure to be
 // deterministic and informative).
-func TestApplyTestConfig_NonLeaderErrors(t *testing.T) {
+func TestTestConfig_NonLeaderErrors(t *testing.T) {
 	// Three-node fixture so we have a clear "not the leader" node.
 	if testing.Short() {
 		t.Skip("3-node smoke skipped in -short mode")
@@ -187,9 +185,9 @@ func TestApplyTestConfig_NonLeaderErrors(t *testing.T) {
 	require.NotNil(t, leader)
 	require.NotNil(t, follower)
 
-	check := DefaultDebugCriticalCheck()
-	_, err := follower.ApplyTestConfig(&check)
-	require.Error(t, err, "non-leader must refuse ApplyTestConfig")
+	check := defaultTestCriticalCheck()
+	_, err := follower.applyTestConfig(&check)
+	require.Error(t, err, "non-leader must refuse test config application")
 	assert.Contains(t, strings.ToLower(err.Error()), "not leader")
 }