fix(ci): restore merged main static gates (#6609)

crates/ecstore/src/object_api/mod.rs

@@ -77,6 +77,7 @@ pub(crate) fn has_encrypted_part_layout_marker(metadata: &HashMap<String, String
 }
 
 pub(crate) fn legacy_encrypted_range_seek_enabled() -> bool {
+    // RUSTFS_COMPAT_TODO(backlog-1316): keep the rolling-upgrade kill switch. Remove after the minimum supported release uses the marker protocol.
     // On by default (backlog-1316 Phase A): every misfit direction falls back to the
     // conservative full read — MPUs created without a candidate marker, completions
     // that cannot revalidate the candidate against the data_dir under the uploadId

crates/kms/src/config_secret.rs

@@ -79,7 +79,13 @@ const SECRET_FIELDS: &[SecretField] = &[
         label: "kms.local.master_key",
     },
     SecretField {
-        segments: &[&["backend_config"], &["VaultKV2", "Vault"], &["auth_method"], &["Token"], &["token"]],
+        segments: &[
+            &["backend_config"],
+            &["VaultKV2", "Vault"],
+            &["auth_method"],
+            &["Token"],
+            &["token"],
+        ],
         label: "kms.vault.token",
     },
     SecretField {
@@ -93,7 +99,13 @@ const SECRET_FIELDS: &[SecretField] = &[
         label: "kms.vault.approle.secret_id",
     },
     SecretField {
-        segments: &[&["backend_config"], &["VaultTransit"], &["auth_method"], &["Token"], &["token"]],
+        segments: &[
+            &["backend_config"],
+            &["VaultTransit"],
+            &["auth_method"],
+            &["Token"],
+            &["token"],
+        ],
         label: "kms.vault_transit.token",
     },
     SecretField {
@@ -279,9 +291,7 @@ fn open_value(label: &str, sealed: &str, secret: &str) -> Result<String> {
     let encoded = sealed
         .strip_prefix(SEALED_VALUE_PREFIX)
         .expect("caller checks the sealed prefix");
-    let payload = BASE64_STANDARD
-        .decode(encoded)
-        .map_err(|_| sealed_value_unreadable(label))?;
+    let payload = BASE64_STANDARD.decode(encoded).map_err(|_| sealed_value_unreadable(label))?;
     if payload.len() <= LOCAL_KMS_MASTER_KEY_SALT_LEN + NONCE_LEN {
         return Err(sealed_value_unreadable(label));
     }