fix: assorted bug fixes for CH migration

Fix resource leaks, race conditions, and error handling across host
agent and control plane: proper sparse file cleanup on close error,
connect error wrapping for MakeDir, CoW file cleanup on pause failure,
per-sandbox VM directories, deferred map deletion to avoid race in VM
destroy, and goroutine launch for extension background workers.

internal/vm/config.go

@@ -77,7 +77,7 @@ func (c *VMConfig) applyDefaults() {
 		c.SocketPath = fmt.Sprintf("/tmp/ch-%s.sock", c.SandboxID)
 	}
 	if c.SandboxDir == "" {
-		c.SandboxDir = "/tmp/ch-vm"
+		c.SandboxDir = fmt.Sprintf("/tmp/ch-vm-%s", c.SandboxID)
 	}
 	if c.TapDevice == "" {
 		c.TapDevice = "tap0"