refactor: polish control plane and host agent code

- Decompose executeBuild (318 lines) into provisionBuildSandbox and
  finalizeBuild helpers for readability
- Extract cleanupPauseFailure in sandbox manager to unify 3 inconsistent
  inline teardown paths (also fixes CoW file leak on rename failure)
- Remove unused ctx parameter from startProcess/startProcessForRestore
- Add missing MASQUERADE rollback entry in CreateNetwork for symmetry
- Consolidate duplicate writeJSON for UTF-8/base64 exec response

internal/vm/manager.go

@@ -47,7 +47,7 @@ func (m *Manager) Create(ctx context.Context, cfg VMConfig) (*VM, error) {
 	)
 
 	// Step 1: Launch the Cloud Hypervisor process.
-	proc, err := startProcess(ctx, &cfg)
+	proc, err := startProcess(&cfg)
 	if err != nil {
 		return nil, fmt.Errorf("start process: %w", err)
 	}
@@ -220,7 +220,7 @@ func (m *Manager) CreateFromSnapshot(ctx context.Context, cfg VMConfig, snapshot
 	)
 
 	// Step 1: Launch bare CH process (no --restore).
-	proc, err := startProcessForRestore(ctx, &cfg)
+	proc, err := startProcessForRestore(&cfg)
 	if err != nil {
 		return nil, fmt.Errorf("start process: %w", err)
 	}

internal/vm/process.go

@@ -30,7 +30,7 @@ type process struct {
 //  4. symlink kernel and rootfs into SandboxDir
 //  5. ip netns exec <ns>: enters the network namespace where TAP is configured
 //  6. exec cloud-hypervisor with the API socket path
-func startProcess(ctx context.Context, cfg *VMConfig) (*process, error) {
+func startProcess(cfg *VMConfig) (*process, error) {
 	script := buildStartScript(cfg)
 	return launchScript(script, cfg)
 }
@@ -38,7 +38,7 @@ func startProcess(ctx context.Context, cfg *VMConfig) (*process, error) {
 // startProcessForRestore launches a bare Cloud Hypervisor process (no --restore).
 // The restore is performed via the API after the socket is ready, which allows
 // passing memory_restore_mode=OnDemand for UFFD lazy paging.
-func startProcessForRestore(ctx context.Context, cfg *VMConfig) (*process, error) {
+func startProcessForRestore(cfg *VMConfig) (*process, error) {
 	script := buildRestoreScript(cfg)
 	return launchScript(script, cfg)
 }