CI: remove k8s stages, fix the Docker-level pipeline green

Survey + fixes so the pipeline passes at the Docker level (no k8s).

- Remove k8s: drop the `sandbox-k8s` job (kind/Calico/--features k8s-tests) and the
  "Helm chart lints" gate step. release.yml was already k8s-clean.
- Rust job:
  - `cargo fmt --all` — fix pre-existing formatting drift (fmt --check was failing).
  - clippy -D warnings: fix 3 lib warnings (cm-brain sort_by_key→Reverse, cm-api
    fleet.rs doc list indentation, node_rules map_or→is_none_or).
  - Regenerate the .sqlx offline cache (was missing the cm-runtime run_loop test
    query → offline compile failed). DB-backed tests use testcontainers at runtime.
  - Set SQLX_OFFLINE=true on the rust + e2e jobs so query! macros compile against
    the committed cache deterministically (no DB needed at compile time).
- Frontend job:
  - Fix the 1 ESLint error (useAgentTelemetry: no setState-synchronously-in-effect;
    tag the slice with agentId + derive null on mismatch).
  - Fix 2 stale panel-params tests (`terminal` is a valid app id now; assert the
    current APP_IDS + use a genuinely-unknown id for the reject case).

Verified locally: fmt clean, clippy --all-targets -D warnings clean (offline),
frontend lint 0 errors, tsc clean, 86/86 frontend tests pass, build OK.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

crates/cm-api/src/routes/teams.rs

@@ -79,10 +79,13 @@ pub(crate) async fn build_team(
         };
         cm_db::repo::agents::insert(&state.pool, &agent, &AccessPolicy::default()).await?;
         let claw_id = agent.id.as_uuid();
-        provisioner.provision_claw(claw_id, &m.model).await.map_err(|e| {
-            eprintln!("teams: provision claw {claw_id} failed: {e}");
-            ApiError::Internal
-        })?;
+        provisioner
+            .provision_claw(claw_id, &m.model)
+            .await
+            .map_err(|e| {
+                eprintln!("teams: provision claw {claw_id} failed: {e}");
+                ApiError::Internal
+            })?;
         cm_db::repo::agents::set_model_binding(&state.pool, agent.id, &m.model).await?;
         claw_ids.push(claw_id);
     }
@@ -98,10 +101,19 @@ pub(crate) async fn build_team(
 
     let team_id = Uuid::now_v7();
     let graph_json = serde_json::to_value(&graph).map_err(|_| ApiError::Internal)?;
-    cm_db::repo::teams::insert_team(&state.pool, team_id, workspace_id, name, kind.as_str(), &graph_json).await?;
+    cm_db::repo::teams::insert_team(
+        &state.pool,
+        team_id,
+        workspace_id,
+        name,
+        kind.as_str(),
+        &graph_json,
+    )
+    .await?;
     for (i, node) in graph.nodes.iter().enumerate() {
         if let Some(cid) = claw_ids.get(i) {
-            cm_db::repo::teams::add_member(&state.pool, team_id, &node.id, *cid, &node.role).await?;
+            cm_db::repo::teams::add_member(&state.pool, team_id, &node.id, *cid, &node.role)
+                .await?;
         }
     }
     Ok((team_id, claw_ids))
@@ -122,7 +134,12 @@ pub async fn create_team(
         &body.members,
     )
     .await?;
-    Ok((StatusCode::CREATED, Json(TeamCreated { team_id: team_id.to_string() })))
+    Ok((
+        StatusCode::CREATED,
+        Json(TeamCreated {
+            team_id: team_id.to_string(),
+        }),
+    ))
 }
 
 #[derive(Deserialize)]
@@ -146,12 +163,17 @@ pub async fn create_team_from_claws(
     if body.claw_ids.is_empty() {
         return Err(ApiError::BadRequest);
     }
-    let kind = parse_kind(if body.kind.is_empty() { "hub_spoke" } else { &body.kind })?;
+    let kind = parse_kind(if body.kind.is_empty() {
+        "hub_spoke"
+    } else {
+        &body.kind
+    })?;
 
     // Resolve + authorize each claw, collecting its role for the topology.
     let mut roles: Vec<String> = Vec::with_capacity(body.claw_ids.len());
     for cid in &body.claw_ids {
-        let agent = crate::routes::claws::workspace_agent(&state, &user, AgentId::from(*cid)).await?;
+        let agent =
+            crate::routes::claws::workspace_agent(&state, &user, AgentId::from(*cid)).await?;
         roles.push(if agent.job_title.is_empty() {
             "claw".into()
         } else {
@@ -291,7 +313,12 @@ pub async fn patch_team(
         .collect();
     let n = by_node.len();
     let roles: Vec<String> = (0..n)
-        .map(|i| by_node.get(&format!("n{i}")).map(|(_, r)| r.clone()).unwrap_or_else(|| "claw".into()))
+        .map(|i| {
+            by_node
+                .get(&format!("n{i}"))
+                .map(|(_, r)| r.clone())
+                .unwrap_or_else(|| "claw".into())
+        })
         .collect();
     let role_refs: Vec<&str> = roles.iter().map(String::as_str).collect();
     let mut graph = build(kind, &role_refs).map_err(|_| ApiError::BadRequest)?;
@@ -302,7 +329,14 @@ pub async fn patch_team(
         }
     }
     let graph_json = serde_json::to_value(&graph).map_err(|_| ApiError::Internal)?;
-    cm_db::repo::teams::set_topology(&state.pool, team.id, user.workspace_id, kind.as_str(), &graph_json).await?;
+    cm_db::repo::teams::set_topology(
+        &state.pool,
+        team.id,
+        user.workspace_id,
+        kind.as_str(),
+        &graph_json,
+    )
+    .await?;
     Ok(StatusCode::NO_CONTENT)
 }