style: fmt + clippy cleanup after Phase C

cargo fmt regroups; three clippy fixes:
- F-S-006: hoist MAX_API_KEY_CANDIDATES to module scope to satisfy
  clippy::items_after_statements.
- F-S-009: use map_or instead of map().unwrap_or() per
  clippy::map_unwrap_or.
- F-P-012: replace `|c| c.encode()` closure with the method itself
  per clippy::redundant_closure_for_method_calls.

No behavior change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/manager-core/src/dispatcher.rs

@@ -311,7 +311,12 @@ impl Dispatcher {
         };
         let outcome = self
             .executor
-            .execute_with_identity(identity, &script.source, exec_req, async_exec_timeout_from_env())
+            .execute_with_identity(
+                identity,
+                &script.source,
+                exec_req,
+                async_exec_timeout_from_env(),
+            )
             .await;
         drop(permit);