fix(worker): harden control-plane lifecycle

- reconnect safely after token rotation and retry leased results
- reject malformed tasks and remove production cluster debug mutation
- validate environment files and require immutable container images

BREAKING CHANGE: Docker install, deploy, and Compose now require an
immutable repository@sha256 image reference.

internal/workercluster/test_config_test.go

@@ -0,0 +1,49 @@
+package workercluster
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/hashicorp/raft"
+)
+
+// defaultTestCriticalCheck is test-only scaffold input for replication tests.
+func defaultTestCriticalCheck() CriticalCheckConfig {
+	return CriticalCheckConfig{
+		ID:        9999,
+		Kind:      "distributed_critical",
+		IntervalS: 30,
+		Target:    "http://example.com",
+		Epoch:     time.Now().UTC().UnixNano(),
+	}
+}
+
+// applyTestConfig is deliberately compiled only into workercluster tests.
+func (c *Cluster) applyTestConfig(check *CriticalCheckConfig) (uint64, error) {
+	c.mu.Lock()
+	r := c.raft
+	c.mu.Unlock()
+	if r == nil {
+		return 0, errors.New("workercluster: not started")
+	}
+	if r.State() != raft.Leader {
+		return 0, errors.New("workercluster: not leader; submit on the leader")
+	}
+
+	payload := ConfigAdoptPayload{Version: 1, Actor: c.opts.NodeID, Checks: []CriticalCheckConfig{*check}}
+	raw, err := json.Marshal(payload)
+	if err != nil {
+		return 0, fmt.Errorf("workercluster: encode payload: %w", err)
+	}
+	entry, err := EncodeEntry(&Entry{Type: EntryConfigAdopt, Adopted: raw})
+	if err != nil {
+		return 0, fmt.Errorf("workercluster: encode entry: %w", err)
+	}
+	fut := r.Apply(entry, 10*time.Second)
+	if err := fut.Error(); err != nil {
+		return 0, fmt.Errorf("workercluster: apply test config: %w", err)
+	}
+	return fut.Index(), nil
+}