CI: remove k8s stages, fix the Docker-level pipeline green

Survey + fixes so the pipeline passes at the Docker level (no k8s).

- Remove k8s: drop the `sandbox-k8s` job (kind/Calico/--features k8s-tests) and the
  "Helm chart lints" gate step. release.yml was already k8s-clean.
- Rust job:
  - `cargo fmt --all` — fix pre-existing formatting drift (fmt --check was failing).
  - clippy -D warnings: fix 3 lib warnings (cm-brain sort_by_key→Reverse, cm-api
    fleet.rs doc list indentation, node_rules map_or→is_none_or).
  - Regenerate the .sqlx offline cache (was missing the cm-runtime run_loop test
    query → offline compile failed). DB-backed tests use testcontainers at runtime.
  - Set SQLX_OFFLINE=true on the rust + e2e jobs so query! macros compile against
    the committed cache deterministically (no DB needed at compile time).
- Frontend job:
  - Fix the 1 ESLint error (useAgentTelemetry: no setState-synchronously-in-effect;
    tag the slice with agentId + derive null on mismatch).
  - Fix 2 stale panel-params tests (`terminal` is a valid app id now; assert the
    current APP_IDS + use a genuinely-unknown id for the reject case).

Verified locally: fmt clean, clippy --all-targets -D warnings clean (offline),
frontend lint 0 errors, tsc clean, 86/86 frontend tests pass, build OK.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

crates/cm-db/src/repo/agent_containers.rs

@@ -114,11 +114,7 @@ pub async fn reset_sessions(pool: &PgPool, kind: &str) -> Result<(), DbError> {
 }
 
 /// Session-less containers untouched for longer than `idle_secs` (0 = all).
-pub async fn idle(
-    pool: &PgPool,
-    kind: &str,
-    idle_secs: i64,
-) -> Result<Vec<ManagedRow>, DbError> {
+pub async fn idle(pool: &PgPool, kind: &str, idle_secs: i64) -> Result<Vec<ManagedRow>, DbError> {
     let rows = sqlx::query(
         "SELECT agent_id, node_id, container_id, name FROM agent_containers
          WHERE kind = $1 AND session_count <= 0
@@ -133,10 +129,12 @@ pub async fn idle(
 
 /// Every recorded container of a kind (for reconcile + shutdown).
 pub async fn all(pool: &PgPool, kind: &str) -> Result<Vec<ManagedRow>, DbError> {
-    let rows = sqlx::query("SELECT agent_id, node_id, container_id, name FROM agent_containers WHERE kind = $1")
-        .bind(kind)
-        .fetch_all(pool)
-        .await?;
+    let rows = sqlx::query(
+        "SELECT agent_id, node_id, container_id, name FROM agent_containers WHERE kind = $1",
+    )
+    .bind(kind)
+    .fetch_all(pool)
+    .await?;
     Ok(rows.into_iter().map(map_managed).collect())
 }
 

crates/cm-db/src/repo/agents.rs

@@ -296,14 +296,18 @@ pub async fn hard_purge(pool: &PgPool, agent_id: AgentId) -> Result<PurgeCounts,
     .bind(aid)
     .execute(&mut *tx)
     .await?;
-    sqlx::query("DELETE FROM messages WHERE session_id IN (SELECT id FROM sessions WHERE agent_id = $1)")
-        .bind(aid)
-        .execute(&mut *tx)
-        .await?;
-    sqlx::query("DELETE FROM agent_runs WHERE session_id IN (SELECT id FROM sessions WHERE agent_id = $1)")
-        .bind(aid)
-        .execute(&mut *tx)
-        .await?;
+    sqlx::query(
+        "DELETE FROM messages WHERE session_id IN (SELECT id FROM sessions WHERE agent_id = $1)",
+    )
+    .bind(aid)
+    .execute(&mut *tx)
+    .await?;
+    sqlx::query(
+        "DELETE FROM agent_runs WHERE session_id IN (SELECT id FROM sessions WHERE agent_id = $1)",
+    )
+    .bind(aid)
+    .execute(&mut *tx)
+    .await?;
     c.sessions = sqlx::query("DELETE FROM sessions WHERE agent_id = $1")
         .bind(aid)
         .execute(&mut *tx)
@@ -325,10 +329,22 @@ pub async fn hard_purge(pool: &PgPool, agent_id: AgentId) -> Result<PurgeCounts,
         .rows_affected();
 
     // Inter-agent threads, queued mail, oauth flows.
-    sqlx::query("DELETE FROM thread_messages WHERE from_agent = $1").bind(aid).execute(&mut *tx).await?;
-    sqlx::query("DELETE FROM thread_participants WHERE agent_id = $1").bind(aid).execute(&mut *tx).await?;
-    sqlx::query("DELETE FROM outbox WHERE agent_id = $1").bind(aid).execute(&mut *tx).await?;
-    sqlx::query("DELETE FROM oauth_states WHERE agent_id = $1").bind(aid).execute(&mut *tx).await?;
+    sqlx::query("DELETE FROM thread_messages WHERE from_agent = $1")
+        .bind(aid)
+        .execute(&mut *tx)
+        .await?;
+    sqlx::query("DELETE FROM thread_participants WHERE agent_id = $1")
+        .bind(aid)
+        .execute(&mut *tx)
+        .await?;
+    sqlx::query("DELETE FROM outbox WHERE agent_id = $1")
+        .bind(aid)
+        .execute(&mut *tx)
+        .await?;
+    sqlx::query("DELETE FROM oauth_states WHERE agent_id = $1")
+        .bind(aid)
+        .execute(&mut *tx)
+        .await?;
     c.connections = sqlx::query("DELETE FROM app_connections WHERE agent_id = $1")
         .bind(aid)
         .execute(&mut *tx)
@@ -339,7 +355,10 @@ pub async fn hard_purge(pool: &PgPool, agent_id: AgentId) -> Result<PurgeCounts,
         .execute(&mut *tx)
         .await?
         .rows_affected();
-    sqlx::query("DELETE FROM usage_events WHERE agent_id = $1").bind(aid).execute(&mut *tx).await?;
+    sqlx::query("DELETE FROM usage_events WHERE agent_id = $1")
+        .bind(aid)
+        .execute(&mut *tx)
+        .await?;
 
     // Finally the agent itself (cascades the rest).
     let n = sqlx::query("DELETE FROM agents WHERE id = $1")

crates/cm-db/src/repo/companies.rs

@@ -70,13 +70,15 @@ pub async fn set_topology(
     kind: &str,
     graph: &Value,
 ) -> Result<(), DbError> {
-    let res = sqlx::query("UPDATE companies SET kind = $3, graph = $4 WHERE id = $1 AND workspace_id = $2")
-        .bind(id)
-        .bind(workspace_id.as_uuid())
-        .bind(kind)
-        .bind(graph)
-        .execute(pool)
-        .await?;
+    let res = sqlx::query(
+        "UPDATE companies SET kind = $3, graph = $4 WHERE id = $1 AND workspace_id = $2",
+    )
+    .bind(id)
+    .bind(workspace_id.as_uuid())
+    .bind(kind)
+    .bind(graph)
+    .execute(pool)
+    .await?;
     if res.rows_affected() == 0 {
         return Err(DbError::NotFound);
     }
@@ -84,7 +86,11 @@ pub async fn set_topology(
 }
 
 /// Delete a company and its node→team bindings (teams themselves remain).
-pub async fn delete_company(pool: &PgPool, id: Uuid, workspace_id: WorkspaceId) -> Result<(), DbError> {
+pub async fn delete_company(
+    pool: &PgPool,
+    id: Uuid,
+    workspace_id: WorkspaceId,
+) -> Result<(), DbError> {
     sqlx::query("DELETE FROM company_teams WHERE company_id = $1")
         .bind(id)
         .execute(pool)

crates/cm-db/src/repo/fleet_beszel.rs

@@ -39,15 +39,13 @@ pub async fn set(
 }
 
 /// Get a workspace's stored Beszel connection, if any.
-pub async fn get(
-    pool: &PgPool,
-    workspace_id: WorkspaceId,
-) -> Result<Option<BeszelConn>, DbError> {
-    let row =
-        sqlx::query("SELECT hub_url, username, password FROM workspace_beszel WHERE workspace_id = $1")
-            .bind(workspace_id.as_uuid())
-            .fetch_optional(pool)
-            .await?;
+pub async fn get(pool: &PgPool, workspace_id: WorkspaceId) -> Result<Option<BeszelConn>, DbError> {
+    let row = sqlx::query(
+        "SELECT hub_url, username, password FROM workspace_beszel WHERE workspace_id = $1",
+    )
+    .bind(workspace_id.as_uuid())
+    .fetch_optional(pool)
+    .await?;
     Ok(row.map(|r| BeszelConn {
         hub_url: r.get("hub_url"),
         username: r.get("username"),
@@ -57,9 +55,10 @@ pub async fn get(
 
 /// Every workspace with a Beszel hub connected (for the background poll task).
 pub async fn all(pool: &PgPool) -> Result<Vec<(WorkspaceId, BeszelConn)>, DbError> {
-    let rows = sqlx::query("SELECT workspace_id, hub_url, username, password FROM workspace_beszel")
-        .fetch_all(pool)
-        .await?;
+    let rows =
+        sqlx::query("SELECT workspace_id, hub_url, username, password FROM workspace_beszel")
+            .fetch_all(pool)
+            .await?;
     Ok(rows
         .into_iter()
         .map(|r| {

crates/cm-db/src/repo/fleet_tailscale.rs

@@ -32,10 +32,11 @@ pub async fn get(
     pool: &PgPool,
     workspace_id: WorkspaceId,
 ) -> Result<Option<(String, String)>, DbError> {
-    let row = sqlx::query("SELECT api_key, tailnet FROM workspace_tailscale WHERE workspace_id = $1")
-        .bind(workspace_id.as_uuid())
-        .fetch_optional(pool)
-        .await?;
+    let row =
+        sqlx::query("SELECT api_key, tailnet FROM workspace_tailscale WHERE workspace_id = $1")
+            .bind(workspace_id.as_uuid())
+            .fetch_optional(pool)
+            .await?;
     Ok(row.map(|r| (r.get("api_key"), r.get("tailnet"))))
 }
 

crates/cm-db/src/repo/node_metrics.rs

@@ -135,7 +135,10 @@ pub async fn latest(pool: &PgPool, node_id: NodeId) -> Result<Option<Value>, DbE
     Ok(row.map(|r| {
         let mut data: Value = r.get("data");
         if let Some(obj) = data.as_object_mut() {
-            obj.insert("updatedAt".into(), serde_json::json!(r.get::<i64, _>("updated")));
+            obj.insert(
+                "updatedAt".into(),
+                serde_json::json!(r.get::<i64, _>("updated")),
+            );
         }
         data
     }))

crates/cm-db/src/repo/teams.rs

@@ -69,13 +69,14 @@ pub async fn set_topology(
     kind: &str,
     graph: &Value,
 ) -> Result<(), DbError> {
-    let res = sqlx::query("UPDATE teams SET kind = $3, graph = $4 WHERE id = $1 AND workspace_id = $2")
-        .bind(id)
-        .bind(workspace_id.as_uuid())
-        .bind(kind)
-        .bind(graph)
-        .execute(pool)
-        .await?;
+    let res =
+        sqlx::query("UPDATE teams SET kind = $3, graph = $4 WHERE id = $1 AND workspace_id = $2")
+            .bind(id)
+            .bind(workspace_id.as_uuid())
+            .bind(kind)
+            .bind(graph)
+            .execute(pool)
+            .await?;
     if res.rows_affected() == 0 {
         return Err(DbError::NotFound);
     }
@@ -83,7 +84,11 @@ pub async fn set_topology(
 }
 
 /// Delete a team and its node→claw bindings.
-pub async fn delete_team(pool: &PgPool, id: Uuid, workspace_id: WorkspaceId) -> Result<(), DbError> {
+pub async fn delete_team(
+    pool: &PgPool,
+    id: Uuid,
+    workspace_id: WorkspaceId,
+) -> Result<(), DbError> {
     sqlx::query("DELETE FROM team_members WHERE team_id = $1")
         .bind(id)
         .execute(pool)