Add per-sandbox CPU/memory/disk metrics collection

Samples /proc/{fc_pid}/stat (CPU%), /proc/{fc_pid}/status (VmRSS), and
stat() on CoW files at 500ms intervals per running sandbox. Three tiered
ring buffers downsample into 30s and 5min averages for 10min/2h/24h
retention. Metrics are flushed to DB on pause (all tiers) and destroy
(24h only). New GetSandboxMetrics and FlushSandboxMetrics RPCs on the
host agent, proxied through GET /v1/sandboxes/{id}/metrics?range= on
the control plane. Returns live data for running sandboxes, DB data for
paused, and 404 for stopped.

db/migrations/20260325135035_add_sandbox_metric_points.sql

@@ -0,0 +1,16 @@
+-- +goose Up
+CREATE TABLE sandbox_metric_points (
+    sandbox_id TEXT        NOT NULL,
+    tier       TEXT        NOT NULL CHECK (tier IN ('10m', '2h', '24h')),
+    ts         BIGINT      NOT NULL,
+    cpu_pct    FLOAT8      NOT NULL DEFAULT 0,
+    mem_bytes  BIGINT      NOT NULL DEFAULT 0,
+    disk_bytes BIGINT      NOT NULL DEFAULT 0,
+    PRIMARY KEY (sandbox_id, tier, ts)
+);
+
+CREATE INDEX idx_sandbox_metric_points_sandbox_tier
+    ON sandbox_metric_points (sandbox_id, tier);
+
+-- +goose Down
+DROP TABLE IF EXISTS sandbox_metric_points;