Add interactive PTY terminal sessions for sandboxes

Wire envd's existing PTY process capabilities through the full stack:
hostagent proto (4 new RPCs: PtyAttach, PtySendInput, PtyResize, PtyKill),
envdclient, sandbox manager, and a new WebSocket endpoint at
GET /v1/sandboxes/{id}/pty with bidirectional JSON message protocol.

Sessions use tag-based identity for disconnect/reconnect support,
base64-encoded PTY data for binary safety, and a 120s inactivity timeout.

internal/id/id.go

@@ -167,6 +167,11 @@ func UUIDString(id pgtype.UUID) string {
 	return uuid.UUID(id.Bytes).String()
 }
 
+// NewPtyTag generates a PTY session tag: 8 random hex characters.
+func NewPtyTag() string {
+	return hex8()
+}
+
 // --- Helpers ---
 
 func hex8() string {