fix(clippy): address rust 1.95 clippy lints

CI uses rustc 1.95 which catches lints not present in 1.93. Apply
suggested fixes:
- map(...).unwrap_or(false) -> is_ok_and(...)
- map(f).unwrap_or(default) -> map_or(default, f)
- Drop unnecessary trailing commas in macro args
- Replace manual is_some_and pattern with .is_ok_and(...)
- Replace sort_by(|a,b| a.cmp(b)) with sort_by_key
- Add module-level allow(result_large_err) on driver gRPC handlers
  that stream tonic::Status, mirroring openshell-server's grpc/* files.

Author: drew

crates/openshell-bootstrap/src/docker.rs

@@ -749,10 +749,7 @@ pub async fn ensure_container(
     // When OPENSHELL_PUSH_IMAGES is set the entrypoint overrides the baked-in
     // HelmChart manifest so k3s uses the locally-pushed images with
     // IfNotPresent pull policy instead of pulling from the remote registry.
-    let push_mode = std::env::var("OPENSHELL_PUSH_IMAGES")
-        .ok()
-        .filter(|v| !v.trim().is_empty())
-        .is_some();
+    let push_mode = std::env::var("OPENSHELL_PUSH_IMAGES").is_ok_and(|v| !v.trim().is_empty());
     let effective_tag = std::env::var("IMAGE_TAG")
         .ok()
         .filter(|v| !v.trim().is_empty())

crates/openshell-cli/src/auth.rs

@@ -94,8 +94,7 @@ pub async fn browser_auth_flow(gateway_endpoint: &str) -> Result<String> {
     // listener, spawns a callback server, and waits the full AUTH_TIMEOUT
     // (120 s) for a POST that will never arrive.
     let no_browser = std::env::var("OPENSHELL_NO_BROWSER")
-        .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
-        .unwrap_or(false);
+        .is_ok_and(|v| v == "1" || v.eq_ignore_ascii_case("true"));
     if no_browser {
         return Err(miette::miette!(
             "authentication skipped (OPENSHELL_NO_BROWSER is set).\n\

crates/openshell-cli/src/main.rs

@@ -151,7 +151,7 @@ fn resolve_sandbox_name(name: Option<String>, gateway: &str) -> Result<String> {
              Specify a sandbox name or connect to one first: nav sandbox connect <name>"
         )
     })?;
-    eprintln!("{} Using sandbox '{}' (last used)", "→".bold(), last.bold(),);
+    eprintln!("{} Using sandbox '{}' (last used)", "→".bold(), last.bold());
     Ok(last)
 }
 
@@ -1869,7 +1869,7 @@ async fn main() -> Result<()> {
             } else {
                 println!("{}", "Gateway Status".cyan().bold());
                 println!();
-                println!("  {} No gateway configured.", "Status:".dimmed(),);
+                println!("  {} No gateway configured.", "Status:".dimmed());
                 println!();
                 println!(
                     "Deploy a gateway with: {}",
@@ -1892,7 +1892,7 @@ async fn main() -> Result<()> {
                             eprintln!("→ Found forward on sandbox '{n}'");
                             n
                         } else {
-                            eprintln!("{} No active forward found for port {port}", "!".yellow(),);
+                            eprintln!("{} No active forward found for port {port}", "!".yellow());
                             return Ok(());
                         }
                     }

crates/openshell-cli/src/run.rs

@@ -429,9 +429,7 @@ const CLUSTER_DEPLOY_LOG_LINES: usize = 15;
 
 /// Return the current terminal width, falling back to 80 columns.
 fn term_width() -> usize {
-    crossterm::terminal::size()
-        .map(|(w, _)| w as usize)
-        .unwrap_or(80)
+    crossterm::terminal::size().map_or(80, |(w, _)| w as usize)
 }
 
 /// Build a horizontal rule of `─` characters with an optional centered label.
@@ -446,7 +444,7 @@ fn horizontal_rule(label: Option<&str>, width: usize) -> String {
             let remaining = width - text_len;
             let left = remaining / 2;
             let right = remaining - left;
-            format!("{}{}{}", "─".repeat(left), text_with_pad, "─".repeat(right),)
+            format!("{}{}{}", "─".repeat(left), text_with_pad, "─".repeat(right))
         }
         None => "─".repeat(width),
     }
@@ -1182,7 +1180,7 @@ pub async fn gateway_login(name: &str) -> Result<()> {
     let token = crate::auth::browser_auth_flow(&metadata.gateway_endpoint).await?;
     openshell_bootstrap::edge_token::store_edge_token(name, &token)?;
 
-    eprintln!("{} Authenticated to gateway '{name}'", "✓".green().bold(),);
+    eprintln!("{} Authenticated to gateway '{name}'", "✓".green().bold());
 
     Ok(())
 }
@@ -2446,7 +2444,7 @@ pub async fn sandbox_create(
                     )
                     .await?;
                 }
-                eprintln!("  {} Files uploaded", "\u{2713}".green().bold(),);
+                eprintln!("  {} Files uploaded", "\u{2713}".green().bold());
             }
 
             // If --forward was requested, start the background port forward
@@ -4594,7 +4592,7 @@ pub async fn gateway_setting_delete(
             response.settings_revision
         );
     } else {
-        println!("{} Global setting {} not found", "!".yellow(), key,);
+        println!("{} Global setting {} not found", "!".yellow(), key);
     }
     Ok(())
 }

crates/openshell-core/src/paths.rs

@@ -105,9 +105,7 @@ pub fn ensure_parent_dir_restricted(path: &Path) -> Result<()> {
 #[cfg(unix)]
 pub fn is_file_permissions_too_open(path: &Path) -> bool {
     use std::os::unix::fs::PermissionsExt;
-    std::fs::metadata(path)
-        .map(|m| m.permissions().mode() & 0o077 != 0)
-        .unwrap_or(false)
+    std::fs::metadata(path).is_ok_and(|m| m.permissions().mode() & 0o077 != 0)
 }
 
 #[cfg(test)]

crates/openshell-driver-docker/src/lib.rs

@@ -1606,7 +1606,7 @@ fn write_cache_binary_atomic(final_path: &Path, bytes: &[u8]) -> CoreResult<()>
         ))
     })?;
     temp.as_file().sync_all().map_err(|err| {
-        Error::config(format!("failed to sync supervisor binary temp file: {err}",))
+        Error::config(format!("failed to sync supervisor binary temp file: {err}"))
     })?;
 
     #[cfg(unix)]

crates/openshell-driver-kubernetes/src/grpc.rs

@@ -1,6 +1,8 @@
 // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
+#![allow(clippy::result_large_err)] // gRPC handlers return Result<_, tonic::Status>
+
 use futures::{Stream, StreamExt};
 use openshell_core::proto::compute::v1::{
     CreateSandboxRequest, CreateSandboxResponse, DeleteSandboxRequest, DeleteSandboxResponse,

crates/openshell-driver-podman/src/config.rs

@@ -121,12 +121,13 @@ impl PodmanComputeConfig {
         }
         #[cfg(target_os = "linux")]
         {
-            if let Ok(xdg) = std::env::var("XDG_RUNTIME_DIR") {
-                PathBuf::from(xdg).join("podman/podman.sock")
-            } else {
-                let uid = nix::unistd::getuid();
-                PathBuf::from(format!("/run/user/{uid}/podman/podman.sock"))
-            }
+            std::env::var("XDG_RUNTIME_DIR").map_or_else(
+                |_| {
+                    let uid = nix::unistd::getuid();
+                    PathBuf::from(format!("/run/user/{uid}/podman/podman.sock"))
+                },
+                |xdg| PathBuf::from(xdg).join("podman/podman.sock"),
+            )
         }
     }
 }

crates/openshell-driver-podman/src/grpc.rs

@@ -1,6 +1,8 @@
 // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
+#![allow(clippy::result_large_err)] // gRPC handlers return Result<_, tonic::Status>
+
 use futures::{Stream, StreamExt};
 use openshell_core::proto::compute::v1::{
     CreateSandboxRequest, CreateSandboxResponse, DeleteSandboxRequest, DeleteSandboxResponse,

crates/openshell-driver-vm/build.rs

@@ -111,7 +111,7 @@ fn main() {
                 e
             )
         });
-        let size = fs::metadata(&dst_path).map(|m| m.len()).unwrap_or(0);
+        let size = fs::metadata(&dst_path).map_or(0, |m| m.len());
         println!("cargo:warning=Embedded {src_name}: {size} bytes");
     }