Rename sandbox prefix to cl-, add MMDS metadata, fix proxy port routing

- Change sandbox ID prefix from sb- to cl- (capsule) throughout
- Fix proxy URL regex character class: base36 uses 0-9a-z, not just hex
- Add MMDS V2 config and metadata to VM boot flow so envd can read
  WRENN_SANDBOX_ID and WRENN_TEMPLATE_ID from inside the guest
- Pass TemplateID through VMConfig into both fresh and snapshot boot paths

internal/id/id.go

@@ -65,7 +65,7 @@ func NewRefreshToken() string {
 // --- Formatting (pgtype.UUID → prefixed string for API/RPC output) ---
 
 const (
-	PrefixSandbox         = "sb-"
+	PrefixSandbox         = "cl-"
 	PrefixUser            = "usr-"
 	PrefixTeam            = "team-"
 	PrefixAPIKey          = "key-"

internal/id/id_test.go

@@ -46,8 +46,8 @@ func TestFormatParseRoundTrip(t *testing.T) {
 	id := NewSandboxID()
 	formatted := FormatSandboxID(id)
 
-	if formatted[:3] != "sb-" {
-		t.Fatalf("expected sb- prefix, got %s", formatted)
+	if formatted[:3] != "cl-" {
+		t.Fatalf("expected cl- prefix, got %s", formatted)
 	}
 	if len(formatted) != 3+base36IDLen {
 		t.Fatalf("expected %d chars total, got %d: %s", 3+base36IDLen, len(formatted), formatted)