CI: remove k8s stages, fix the Docker-level pipeline green

Survey + fixes so the pipeline passes at the Docker level (no k8s).

- Remove k8s: drop the `sandbox-k8s` job (kind/Calico/--features k8s-tests) and the
  "Helm chart lints" gate step. release.yml was already k8s-clean.
- Rust job:
  - `cargo fmt --all` — fix pre-existing formatting drift (fmt --check was failing).
  - clippy -D warnings: fix 3 lib warnings (cm-brain sort_by_key→Reverse, cm-api
    fleet.rs doc list indentation, node_rules map_or→is_none_or).
  - Regenerate the .sqlx offline cache (was missing the cm-runtime run_loop test
    query → offline compile failed). DB-backed tests use testcontainers at runtime.
  - Set SQLX_OFFLINE=true on the rust + e2e jobs so query! macros compile against
    the committed cache deterministically (no DB needed at compile time).
- Frontend job:
  - Fix the 1 ESLint error (useAgentTelemetry: no setState-synchronously-in-effect;
    tag the slice with agentId + derive null on mismatch).
  - Fix 2 stale panel-params tests (`terminal` is a valid app id now; assert the
    current APP_IDS + use a genuinely-unknown id for the reject case).

Verified locally: fmt clean, clippy --all-targets -D warnings clean (offline),
frontend lint 0 errors, tsc clean, 86/86 frontend tests pass, build OK.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

crates/cm-api/src/routes/beszel.rs

@@ -34,12 +34,23 @@ pub async fn connect(
             json!({ "ok": false, "error": "hubUrl, username and password are required" }),
         ));
     }
-    let conn = BeszelConn { hub_url: hub.clone(), username: username.clone(), password: req.password.clone() };
+    let conn = BeszelConn {
+        hub_url: hub.clone(),
+        username: username.clone(),
+        password: req.password.clone(),
+    };
     // Verify the credentials authenticate before persisting.
     if let Err(e) = beszel::authenticate(&reqwest::Client::new(), &conn).await {
         return Ok(Json(json!({ "ok": false, "error": e })));
     }
-    fleet_beszel::set(&state.pool, user.workspace_id, &hub, &username, &req.password).await?;
+    fleet_beszel::set(
+        &state.pool,
+        user.workspace_id,
+        &hub,
+        &username,
+        &req.password,
+    )
+    .await?;
     Ok(Json(json!({ "ok": true, "hubUrl": hub })))
 }
 
@@ -49,7 +60,9 @@ pub async fn status(
     Authed(user): Authed,
 ) -> Result<Json<Value>, ApiError> {
     let conn = fleet_beszel::get(&state.pool, user.workspace_id).await?;
-    Ok(Json(json!({ "connected": conn.is_some(), "hubUrl": conn.map(|c| c.hub_url) })))
+    Ok(Json(
+        json!({ "connected": conn.is_some(), "hubUrl": conn.map(|c| c.hub_url) }),
+    ))
 }
 
 /// `DELETE /api/fleet/beszel` — disconnect.
@@ -74,9 +87,10 @@ pub async fn node_metrics_get(
         .ok_or(ApiError::NotFound)?;
     let latest = node_metrics::latest(&state.pool, node_id).await?;
     let mut history = json!([]);
-    if let (Some(latest_v), Some(conn)) =
-        (&latest, fleet_beszel::get(&state.pool, user.workspace_id).await?)
-    {
+    if let (Some(latest_v), Some(conn)) = (
+        &latest,
+        fleet_beszel::get(&state.pool, user.workspace_id).await?,
+    ) {
         if let Some(sysid) = latest_v.get("beszelSystemId").and_then(Value::as_str) {
             let client = reqwest::Client::new();
             if let Ok(token) = beszel::authenticate(&client, &conn).await {
@@ -91,7 +105,9 @@ pub async fn node_metrics_get(
 
 // ── Fleet automation rules ──────────────────────────────────────────────────
 
-const METRICS: [&str; 6] = ["cpu_pct", "mem_pct", "disk_pct", "gpu_pct", "temp_max", "load1"];
+const METRICS: [&str; 6] = [
+    "cpu_pct", "mem_pct", "disk_pct", "gpu_pct", "temp_max", "load1",
+];
 const OPS: [&str; 4] = [">", "<", ">=", "<="];
 
 fn rule_json(r: &node_rules::NodeRule) -> Value {
@@ -115,7 +131,9 @@ pub async fn rules_list(
     Authed(user): Authed,
 ) -> Result<Json<Value>, ApiError> {
     let rules = node_rules::list(&state.pool, user.workspace_id).await?;
-    Ok(Json(json!({ "rules": rules.iter().map(rule_json).collect::<Vec<_>>() })))
+    Ok(Json(
+        json!({ "rules": rules.iter().map(rule_json).collect::<Vec<_>>() }),
+    ))
 }
 
 #[derive(Deserialize)]
@@ -138,7 +156,9 @@ pub async fn rules_create(
     Json(req): Json<RuleReq>,
 ) -> Result<Json<Value>, ApiError> {
     if !METRICS.contains(&req.metric.as_str()) || !OPS.contains(&req.op.as_str()) {
-        return Ok(Json(json!({ "ok": false, "error": "invalid metric or operator" })));
+        return Ok(Json(
+            json!({ "ok": false, "error": "invalid metric or operator" }),
+        ));
     }
     let node_id = match req.node_id.as_deref() {
         Some(s) if !s.is_empty() && s != "all" => {