CI: remove k8s stages, fix the Docker-level pipeline green

Survey + fixes so the pipeline passes at the Docker level (no k8s).

- Remove k8s: drop the `sandbox-k8s` job (kind/Calico/--features k8s-tests) and the
  "Helm chart lints" gate step. release.yml was already k8s-clean.
- Rust job:
  - `cargo fmt --all` — fix pre-existing formatting drift (fmt --check was failing).
  - clippy -D warnings: fix 3 lib warnings (cm-brain sort_by_key→Reverse, cm-api
    fleet.rs doc list indentation, node_rules map_or→is_none_or).
  - Regenerate the .sqlx offline cache (was missing the cm-runtime run_loop test
    query → offline compile failed). DB-backed tests use testcontainers at runtime.
  - Set SQLX_OFFLINE=true on the rust + e2e jobs so query! macros compile against
    the committed cache deterministically (no DB needed at compile time).
- Frontend job:
  - Fix the 1 ESLint error (useAgentTelemetry: no setState-synchronously-in-effect;
    tag the slice with agentId + derive null on mismatch).
  - Fix 2 stale panel-params tests (`terminal` is a valid app id now; assert the
    current APP_IDS + use a genuinely-unknown id for the reject case).

Verified locally: fmt clean, clippy --all-targets -D warnings clean (offline),
frontend lint 0 errors, tsc clean, 86/86 frontend tests pass, build OK.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

crates/cm-api/src/routes/files.rs

@@ -23,7 +23,9 @@ fn walk_files<'a>(
         };
         while let Ok(Some(entry)) = rd.next_entry().await {
             let path = entry.path();
-            let Ok(ft) = entry.file_type().await else { continue };
+            let Ok(ft) = entry.file_type().await else {
+                continue;
+            };
             if ft.is_dir() {
                 walk_files(path, base.clone(), out).await;
             } else if ft.is_file() {
@@ -54,7 +56,12 @@ async fn reconcile_drive(
     };
     let dir = root.join(format!("{ws}/{}/{scope}", drive.as_str()));
     let mut disk = HashMap::new();
-    walk_files(dir, root.join(format!("{ws}/{}/{scope}", drive.as_str())), &mut disk).await;
+    walk_files(
+        dir,
+        root.join(format!("{ws}/{}/{scope}", drive.as_str())),
+        &mut disk,
+    )
+    .await;
 
     let db = match cm_db::repo::files::list(pool, ws, drive, agent).await {
         Ok(d) => d,
@@ -171,7 +178,14 @@ pub async fn shared_files(
 ) -> Result<Json<Vec<FileNode>>, ApiError> {
     let agent = workspace_agent(&state, &user, query.claw_id).await?;
     if let Some(root) = &state.file_root {
-        reconcile_drive(&state.pool, root, user.workspace_id, FileDrive::Shared, agent.id).await;
+        reconcile_drive(
+            &state.pool,
+            root,
+            user.workspace_id,
+            FileDrive::Shared,
+            agent.id,
+        )
+        .await;
     }
     let nodes =
         cm_db::repo::files::list(&state.pool, user.workspace_id, FileDrive::Shared, agent.id)