sando: adopt lint block, fix clippy, fmt
sando: content-addressed release identity; key promote/burn-in on build id