Rename sandbox prefix to cl-, add MMDS metadata, fix proxy port routing

- Change sandbox ID prefix from sb- to cl- (capsule) throughout
- Fix proxy URL regex character class: base36 uses 0-9a-z, not just hex
- Add MMDS V2 config and metadata to VM boot flow so envd can read
  WRENN_SANDBOX_ID and WRENN_TEMPLATE_ID from inside the guest
- Pass TemplateID through VMConfig into both fresh and snapshot boot paths

internal/id/id.go

@@ -65,7 +65,7 @@ func NewRefreshToken() string {
 // --- Formatting (pgtype.UUID → prefixed string for API/RPC output) ---
 
 const (
-	PrefixSandbox         = "sb-"
+	PrefixSandbox         = "cl-"
 	PrefixUser            = "usr-"
 	PrefixTeam            = "team-"
 	PrefixAPIKey          = "key-"