Rename sandbox prefix to cl-, add MMDS metadata, fix proxy port routing

- Change sandbox ID prefix from sb- to cl- (capsule) throughout
- Fix proxy URL regex character class: base36 uses 0-9a-z, not just hex
- Add MMDS V2 config and metadata to VM boot flow so envd can read
  WRENN_SANDBOX_ID and WRENN_TEMPLATE_ID from inside the guest
- Pass TemplateID through VMConfig into both fresh and snapshot boot paths

internal/sandbox/manager.go

@@ -169,6 +169,7 @@ func (m *Manager) Create(ctx context.Context, sandboxID string, teamID, template
 	// Boot VM — Firecracker gets the dm device path.
 	vmCfg := vm.VMConfig{
 		SandboxID:        sandboxID,
+		TemplateID:       id.UUIDString(templateID),
 		KernelPath:       layout.KernelPath(m.cfg.WrennDir),
 		RootfsPath:       dmDev.DevicePath,
 		VCPUs:            vcpus,
@@ -1033,6 +1034,7 @@ func (m *Manager) createFromSnapshot(ctx context.Context, sandboxID string, team
 	// Restore VM.
 	vmCfg := vm.VMConfig{
 		SandboxID:        sandboxID,
+		TemplateID:       id.UUIDString(templateID),
 		KernelPath:       layout.KernelPath(m.cfg.WrennDir),
 		RootfsPath:       dmDev.DevicePath,
 		VCPUs:            vcpus,