fix: resolve process stream hangs, pause race, and PTY signal loss

- Cache terminal EndEvent on ProcessHandle so connect() can detect
  already-exited processes instead of hanging forever on broadcast
  receivers that missed the event. Subscribe before checking cache
  to close the TOCTOU window.

- Protect sb.Status writes in Pause with m.mu to prevent data race
  with concurrent readers (AcquireProxyConn, Exec, etc.).

- Restart metrics sampler in restoreRunning so a failed pause attempt
  doesn't permanently kill sandbox metrics collection.

- Return dequeued non-input messages from coalescePtyInput instead of
  dropping them, preventing silent loss of kill/resize signals during
  typing bursts.

internal/sandbox/manager.go

@@ -378,13 +378,18 @@ func (m *Manager) Pause(ctx context.Context, sandboxID string) error {
 	}
 
 	// Mark sandbox as pausing to block new exec/file/PTY operations.
+	m.mu.Lock()
 	sb.Status = models.StatusPausing
+	m.mu.Unlock()
 
 	// restoreRunning reverts state if any pre-freeze step fails.
 	restoreRunning := func() {
 		_ = m.vm.UpdateBalloon(context.Background(), sandboxID, 0)
 		sb.connTracker.Reset()
+		m.mu.Lock()
 		sb.Status = models.StatusRunning
+		m.mu.Unlock()
+		m.startSampler(sb)
 	}
 
 	// Stop the metrics sampler goroutine before tearing down any resources