fix: assorted bug fixes for CH migration

Fix resource leaks, race conditions, and error handling across host
agent and control plane: proper sparse file cleanup on close error,
connect error wrapping for MakeDir, CoW file cleanup on pause failure,
per-sandbox VM directories, deferred map deletion to avoid race in VM
destroy, and goroutine launch for extension background workers.

internal/vm/manager.go

@@ -143,7 +143,6 @@ func (m *Manager) Destroy(ctx context.Context, sandboxID string) error {
 		m.mu.Unlock()
 		return fmt.Errorf("VM not found: %s", sandboxID)
 	}
-	delete(m.vms, sandboxID)
 	m.mu.Unlock()
 
 	slog.Info("destroying VM", "sandbox", sandboxID)
@@ -161,6 +160,10 @@ func (m *Manager) Destroy(ctx context.Context, sandboxID string) error {
 
 	os.Remove(vm.Config.SocketPath)
 
+	m.mu.Lock()
+	delete(m.vms, sandboxID)
+	m.mu.Unlock()
+
 	slog.Info("VM destroyed", "sandbox", sandboxID)
 	return nil
 }