refactor: polish control plane and host agent code

- Decompose executeBuild (318 lines) into provisionBuildSandbox and
  finalizeBuild helpers for readability
- Extract cleanupPauseFailure in sandbox manager to unify 3 inconsistent
  inline teardown paths (also fixes CoW file leak on rename failure)
- Remove unused ctx parameter from startProcess/startProcessForRestore
- Add missing MASQUERADE rollback entry in CreateNetwork for symmetry
- Consolidate duplicate writeJSON for UTF-8/base64 exec response

internal/api/handlers_exec.go

@@ -130,30 +130,22 @@ func (h *execHandler) Exec(w http.ResponseWriter, r *http.Request) {
 
 	updateLastActive(h.db, sandboxID, sandboxIDStr)
 
-	// Use base64 encoding if output contains non-UTF-8 bytes.
 	stdout := resp.Msg.Stdout
 	stderr := resp.Msg.Stderr
-	encoding := "utf-8"
 
+	encoding := "utf-8"
+	stdoutStr, stderrStr := string(stdout), string(stderr)
 	if !utf8.Valid(stdout) || !utf8.Valid(stderr) {
 		encoding = "base64"
-		writeJSON(w, http.StatusOK, execResponse{
-			SandboxID:  sandboxIDStr,
-			Cmd:        req.Cmd,
-			Stdout:     base64.StdEncoding.EncodeToString(stdout),
-			Stderr:     base64.StdEncoding.EncodeToString(stderr),
-			ExitCode:   resp.Msg.ExitCode,
-			DurationMs: duration.Milliseconds(),
-			Encoding:   encoding,
-		})
-		return
+		stdoutStr = base64.StdEncoding.EncodeToString(stdout)
+		stderrStr = base64.StdEncoding.EncodeToString(stderr)
 	}
 
 	writeJSON(w, http.StatusOK, execResponse{
 		SandboxID:  sandboxIDStr,
 		Cmd:        req.Cmd,
-		Stdout:     string(stdout),
-		Stderr:     string(stderr),
+		Stdout:     stdoutStr,
+		Stderr:     stderrStr,
 		ExitCode:   resp.Msg.ExitCode,
 		DurationMs: duration.Milliseconds(),
 		Encoding:   encoding,