CI: remove k8s stages, fix the Docker-level pipeline green

Survey + fixes so the pipeline passes at the Docker level (no k8s).

- Remove k8s: drop the `sandbox-k8s` job (kind/Calico/--features k8s-tests) and the
  "Helm chart lints" gate step. release.yml was already k8s-clean.
- Rust job:
  - `cargo fmt --all` — fix pre-existing formatting drift (fmt --check was failing).
  - clippy -D warnings: fix 3 lib warnings (cm-brain sort_by_key→Reverse, cm-api
    fleet.rs doc list indentation, node_rules map_or→is_none_or).
  - Regenerate the .sqlx offline cache (was missing the cm-runtime run_loop test
    query → offline compile failed). DB-backed tests use testcontainers at runtime.
  - Set SQLX_OFFLINE=true on the rust + e2e jobs so query! macros compile against
    the committed cache deterministically (no DB needed at compile time).
- Frontend job:
  - Fix the 1 ESLint error (useAgentTelemetry: no setState-synchronously-in-effect;
    tag the slice with agentId + derive null on mismatch).
  - Fix 2 stale panel-params tests (`terminal` is a valid app id now; assert the
    current APP_IDS + use a genuinely-unknown id for the reject case).

Verified locally: fmt clean, clippy --all-targets -D warnings clean (offline),
frontend lint 0 errors, tsc clean, 86/86 frontend tests pass, build OK.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

crates/cm-api/src/routes/nodes.rs

@@ -83,7 +83,9 @@ pub async fn list(
     Authed(user): Authed,
 ) -> Result<Json<Value>, ApiError> {
     let rows = nodes::list(&state.pool, user.workspace_id).await?;
-    Ok(Json(json!({ "nodes": rows.iter().map(node_json).collect::<Vec<_>>() })))
+    Ok(Json(
+        json!({ "nodes": rows.iter().map(node_json).collect::<Vec<_>>() }),
+    ))
 }
 
 /// `GET /api/nodes/live` — SSE stream of the node list + health (2s poll).
@@ -116,7 +118,9 @@ pub async fn exec_test(
         .await?
         .ok_or(ApiError::NotFound)?;
     match state.node_hub.verify(node_id).await {
-        Ok(out) => Ok(Json(json!({ "ok": out.ok, "output": out.output, "node": node.name }))),
+        Ok(out) => Ok(Json(
+            json!({ "ok": out.ok, "output": out.output, "node": node.name }),
+        )),
         Err(e) => Ok(Json(json!({ "ok": false, "output": e, "node": node.name }))),
     }
 }
@@ -184,7 +188,9 @@ pub async fn terminal_ticket(
     if !state.node_hub.is_online(node_id).await {
         return Ok(Json(json!({ "error": "node is offline" })));
     }
-    Ok(Json(json!({ "ticket": state.node_hub.mint_ticket(node_id).await })))
+    Ok(Json(
+        json!({ "ticket": state.node_hub.mint_ticket(node_id).await }),
+    ))
 }
 
 /// `GET /api/nodes/{id}/terminal/ws?ticket=…` — bridge a browser xterm to a host
@@ -261,8 +267,14 @@ async fn bridge_terminal(hub: Arc<NodeHub>, node_id: NodeId, socket: WebSocket)
                         // Host shell (no container) — the Infra node terminal.
                         "fallback" => hub.open_pty(node_id, sid, cols, rows, None, None).await,
                         "webrtc_offer" => {
-                            hub.webrtc_offer(node_id, sid, c.sdp.as_deref().unwrap_or(""), None, None)
-                                .await
+                            hub.webrtc_offer(
+                                node_id,
+                                sid,
+                                c.sdp.as_deref().unwrap_or(""),
+                                None,
+                                None,
+                            )
+                            .await
                         }
                         "webrtc_ice" => {
                             hub.webrtc_ice(