fix: assorted bug fixes for CH migration

Fix resource leaks, race conditions, and error handling across host
agent and control plane: proper sparse file cleanup on close error,
connect error wrapping for MakeDir, CoW file cleanup on pause failure,
per-sandbox VM directories, deferred map deletion to avoid race in VM
destroy, and goroutine launch for extension background workers.

internal/sandbox/manager.go

@@ -541,6 +541,7 @@ func (m *Manager) Pause(ctx context.Context, sandboxID string) error {
 			warnErr("snapshot dir cleanup error", sandboxID, os.RemoveAll(pauseDir))
 			warnErr("network cleanup error during pause", sandboxID, network.RemoveNetwork(sb.slot))
 			m.slots.Release(sb.SlotIndex)
+			os.Remove(sb.dmDevice.CowPath)
 			if sb.baseImagePath != "" {
 				m.loops.Release(sb.baseImagePath)
 			}