…kport #23835) (#24116)

Backport of #23835.

Audit and connection log pages were timing out due to expensive COUNT(*)
queries over large tables. This commit adds opt-in count capping:
requests can return a `count_cap` field signaling that the count was
truncated at a threshold, avoiding full table scans that caused page
timeouts.

Text-cast UUID comparisons in regosql-generated authorization queries
also contributed to the slowdown by preventing index usage for
connection and audit log queries. These now emit native UUID operators.

Frontend changes handle the capped state in usePaginatedQuery and
PaginationWidget, optionally displaying a capped count in the pagination
UI (e.g. "Showing 2,076 to 2,100 of 2,000+ logs")

---

Cherry picked from 86ca61d

Cherry-picks two fixes onto `release/2.29` that are both needed together
to unblock CI:

1. **Remove trivy from Dockerfile** (original: #23367, commit
`4c9041b2`) — upstream Trivy v0.41.0 release artifact was deleted,
causing `gzip: stdin: not in gzip format` in the `build_image` job.
2. **Remove subdomain from coder_app with command** (original: #22990,
commit `fd634626`) — `coder_app` no longer supports both `command` and
`subdomain`, causing `deploy_template` to fail on `terraform validate`.

Both commits are required for CI to pass — the first fixes the Docker
build and the second fixes Terraform validation.

> 🤖 Generated by Coder Agents

---------

Co-authored-by: Cian Johnston <cian@coder.com>
Co-authored-by: Ethan <39577870+ethanndickson@users.noreply.github.com>

…e (backport v2.29) (#24249)

Cherry-pick of
17d214b
onto `release/2.29`.

Original PR: #22556

When the workspace parameters page loads, the WebSocket sends an initial
response with template defaults. For parameters with no default, the
server returns `{valid: false, value: ""}`. On first render,
`useSyncFormParameters` overwrites the form's correctly-autofilled value
with `""`. This fix preserves the current form value when the server
value is `{valid: false}`.

Fixes the consistently failing e2e test `create workspace with default
and required parameters`.

> 🤖 Generated by Coder Agents

Co-authored-by: Kyle Carberry <kyle@coder.com>

Cherry-pick of e82edf1 onto
`release/2.29`.

Original PR: #22042

**Conflict resolution:** `testutil/unixsocket.go` was deleted on
`release/2.29` but modified in the original commit — resolved by keeping
it deleted.

**Note:** Merge #24245 first to fix pre-existing CI failures on
`release/2.29`.

> 🤖 Generated by Coder Agents

Co-authored-by: Jon Ayers <jon@coder.com>

## Cherry-pick of #24187 onto `release/2.29`

Bumps `coder/tailscale` to
[`e956a95`](coder/tailscale@e956a95)
([PR #113](coder/tailscale#113)) to pick up the
`RTM_MISS` fix for the Darwin network monitor.

### Why

On Darwin, `RTM_MISS` route-socket messages (fired on every failed route
lookup) were not filtered by `netmon`, causing each one to be treated as
a `LinkChange`. When netcheck sends STUN probes to an IPv6 address with
no route, this creates a self-sustaining feedback loop: `RTM_MISS` →
`LinkChange` → `ReSTUN` → netcheck → v6 STUN probe → `RTM_MISS` → …

The loop drives DERP home-region flapping at ~70× baseline, which at
fleet scale saturates PostgreSQL's `NOTIFY` lock and causes coordinator
health-check timeouts.

The upstream fix adds a single `if msg.Type == unix.RTM_MISS { return
true }` check to `skipRouteMessage`. This is safe because `RTM_MISS` is
a lookup-path signal, not a table-mutation signal — route withdrawals
always emit `RTM_DELETE` before any subsequent lookup can miss.

This issue has only been reported recently, since users updated to macOS
26.4.

### Notes

The cherry-pick resolved as empty due to divergent tailscale base
versions between `main` (`33e050f`) and `release/2.29` (`6eafe0f`). The
dependency was manually updated with `go mod tidy`, which also bumped
the `go` directive to 1.25.7 (required by the new tailscale module) and
pulled in required transitive dependency updates (golang.org/x/*, etc.).

Relates to ENG-2394

> 🤖 Generated by Coder Agents