CI: remove k8s stages, fix the Docker-level pipeline green

Survey + fixes so the pipeline passes at the Docker level (no k8s).

- Remove k8s: drop the `sandbox-k8s` job (kind/Calico/--features k8s-tests) and the
  "Helm chart lints" gate step. release.yml was already k8s-clean.
- Rust job:
  - `cargo fmt --all` — fix pre-existing formatting drift (fmt --check was failing).
  - clippy -D warnings: fix 3 lib warnings (cm-brain sort_by_key→Reverse, cm-api
    fleet.rs doc list indentation, node_rules map_or→is_none_or).
  - Regenerate the .sqlx offline cache (was missing the cm-runtime run_loop test
    query → offline compile failed). DB-backed tests use testcontainers at runtime.
  - Set SQLX_OFFLINE=true on the rust + e2e jobs so query! macros compile against
    the committed cache deterministically (no DB needed at compile time).
- Frontend job:
  - Fix the 1 ESLint error (useAgentTelemetry: no setState-synchronously-in-effect;
    tag the slice with agentId + derive null on mismatch).
  - Fix 2 stale panel-params tests (`terminal` is a valid app id now; assert the
    current APP_IDS + use a genuinely-unknown id for the reject case).

Verified locally: fmt clean, clippy --all-targets -D warnings clean (offline),
frontend lint 0 errors, tsc clean, 86/86 frontend tests pass, build OK.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

crates/cm-db/src/repo/agent_containers.rs

@@ -114,11 +114,7 @@ pub async fn reset_sessions(pool: &PgPool, kind: &str) -> Result<(), DbError> {
 }
 
 /// Session-less containers untouched for longer than `idle_secs` (0 = all).
-pub async fn idle(
-    pool: &PgPool,
-    kind: &str,
-    idle_secs: i64,
-) -> Result<Vec<ManagedRow>, DbError> {
+pub async fn idle(pool: &PgPool, kind: &str, idle_secs: i64) -> Result<Vec<ManagedRow>, DbError> {
     let rows = sqlx::query(
         "SELECT agent_id, node_id, container_id, name FROM agent_containers
          WHERE kind = $1 AND session_count <= 0
@@ -133,10 +129,12 @@ pub async fn idle(
 
 /// Every recorded container of a kind (for reconcile + shutdown).
 pub async fn all(pool: &PgPool, kind: &str) -> Result<Vec<ManagedRow>, DbError> {
-    let rows = sqlx::query("SELECT agent_id, node_id, container_id, name FROM agent_containers WHERE kind = $1")
-        .bind(kind)
-        .fetch_all(pool)
-        .await?;
+    let rows = sqlx::query(
+        "SELECT agent_id, node_id, container_id, name FROM agent_containers WHERE kind = $1",
+    )
+    .bind(kind)
+    .fetch_all(pool)
+    .await?;
     Ok(rows.into_iter().map(map_managed).collect())
 }