CI: remove k8s stages, fix the Docker-level pipeline green

Survey + fixes so the pipeline passes at the Docker level (no k8s).

- Remove k8s: drop the `sandbox-k8s` job (kind/Calico/--features k8s-tests) and the
  "Helm chart lints" gate step. release.yml was already k8s-clean.
- Rust job:
  - `cargo fmt --all` — fix pre-existing formatting drift (fmt --check was failing).
  - clippy -D warnings: fix 3 lib warnings (cm-brain sort_by_key→Reverse, cm-api
    fleet.rs doc list indentation, node_rules map_or→is_none_or).
  - Regenerate the .sqlx offline cache (was missing the cm-runtime run_loop test
    query → offline compile failed). DB-backed tests use testcontainers at runtime.
  - Set SQLX_OFFLINE=true on the rust + e2e jobs so query! macros compile against
    the committed cache deterministically (no DB needed at compile time).
- Frontend job:
  - Fix the 1 ESLint error (useAgentTelemetry: no setState-synchronously-in-effect;
    tag the slice with agentId + derive null on mismatch).
  - Fix 2 stale panel-params tests (`terminal` is a valid app id now; assert the
    current APP_IDS + use a genuinely-unknown id for the reject case).

Verified locally: fmt clean, clippy --all-targets -D warnings clean (offline),
frontend lint 0 errors, tsc clean, 86/86 frontend tests pass, build OK.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

crates/cm-api/src/routes/tailscale.rs

@@ -62,7 +62,9 @@ pub async fn connect(
     let api_key = req.api_key.trim();
     let tailnet = req.tailnet.trim();
     if api_key.is_empty() || tailnet.is_empty() {
-        return Ok(Json(json!({ "ok": false, "error": "apiKey and tailnet are required" })));
+        return Ok(Json(
+            json!({ "ok": false, "error": "apiKey and tailnet are required" }),
+        ));
     }
     fleet_tailscale::set(&state.pool, user.workspace_id, api_key, tailnet).await?;
     Ok(Json(json!({ "ok": true, "tailnet": tailnet })))
@@ -74,7 +76,9 @@ pub async fn status(
     Authed(user): Authed,
 ) -> Result<Json<Value>, ApiError> {
     let conn = fleet_tailscale::get(&state.pool, user.workspace_id).await?;
-    Ok(Json(json!({ "connected": conn.is_some(), "tailnet": conn.map(|(_, t)| t) })))
+    Ok(Json(
+        json!({ "connected": conn.is_some(), "tailnet": conn.map(|(_, t)| t) }),
+    ))
 }
 
 /// `DELETE /api/fleet/tailscale` — disconnect Tailscale.
@@ -92,11 +96,16 @@ pub async fn devices(
     State(state): State<AppState>,
     Authed(user): Authed,
 ) -> Result<Json<Value>, ApiError> {
-    let Some((api_key, tailnet)) = fleet_tailscale::get(&state.pool, user.workspace_id).await? else {
+    let Some((api_key, tailnet)) = fleet_tailscale::get(&state.pool, user.workspace_id).await?
+    else {
         return Ok(Json(json!({ "connected": false, "devices": [] })));
     };
     let url = format!("https://api.tailscale.com/api/v2/tailnet/{tailnet}/devices");
-    let resp = reqwest::Client::new().get(&url).bearer_auth(&api_key).send().await;
+    let resp = reqwest::Client::new()
+        .get(&url)
+        .bearer_auth(&api_key)
+        .send()
+        .await;
     let body = match resp {
         Ok(r) if r.status().is_success() => r.json::<Value>().await.unwrap_or_else(|_| json!({})),
         Ok(r) => {
@@ -127,5 +136,7 @@ pub async fn devices(
                 .collect()
         })
         .unwrap_or_default();
-    Ok(Json(json!({ "connected": true, "tailnet": tailnet, "devices": devices })))
+    Ok(Json(
+        json!({ "connected": true, "tailnet": tailnet, "devices": devices }),
+    ))
 }