Low-severity cleanup from the codebase review

[retr0h]

• Remove unused InjectTraceContext and InjectTraceContextToHeader in internal/telemetry/tracing/propagation.go; nats-client already injects trace context on publish.
• Use errors.Is instead of err == jetstream.ErrNoKeysFound in internal/controller/enrollment/watcher.go:185 and accept.go:200.
• Pass the caller's context through notify.Watcher.detectTransitions (internal/controller/notify/watcher.go:221-291) instead of context.Background().
• Confirm callers of Server.Stop(ctx) (internal/controller/api/server.go:138-154) do not assume the drain has finished when it returns.
• GetAgentTimeline treats every KV error as "no events", hiding real backend failures.
• parseFileMode (internal/provider/file/deploy.go:174-187) silently falls back to 0644 on an unparsable mode.
• Replace the bubble sort in internal/job/client/jobs.go:634-640 with sort.Slice.
• Broadcast collection snapshots expected agents before publishing (internal/job/client/client.go:434,461), so an agent joining in that window is not counted.
• internal/provider/network/netplan/dns/debian_update_resolv_conf_by_interface.go:96 uses context.TODO().
• Enrollment accept and reject find the pending agent by scanning every key (findPendingBy in internal/controller/enrollment/accept.go:194-223). Fine at today's scale; add a comment or an index if pending queues grow.
• Stale doc comment in internal/cli/raw_output.go:37-39 about single-host output.

---

Found in the September 2026 codebase review. Tracked in the review tracking issue.