Fix review findings: IP collision, pause race, proxy path, ENV ordering, conn drain

- Fix IP address collision at slot 32768+ by using bitwise shifts instead of
  byte-truncating division in network slot addressing
- Add per-sandbox lifecycleMu to serialize concurrent Pause/Destroy calls
- Sanitize proxy forwarding path with path.Clean
- Sort ENV keys in recipe shell preamble for deterministic ordering
- Fix ConnTracker goroutine leak by adding cancel channel to Drain/Reset
- Update context_test to assert deterministic ENV ordering

internal/recipe/context.go

@@ -2,6 +2,7 @@ package recipe
 
 import (
 	"regexp"
+	"slices"
 	"strings"
 )
 
@@ -56,10 +57,15 @@ func (c *ExecContext) shellPrefix() string {
 		sb.WriteString(shellescape(c.WorkDir))
 		sb.WriteString(" && ")
 	}
-	for k, v := range c.EnvVars {
+	keys := make([]string, 0, len(c.EnvVars))
+	for k := range c.EnvVars {
+		keys = append(keys, k)
+	}
+	slices.Sort(keys)
+	for _, k := range keys {
 		sb.WriteString(k)
 		sb.WriteByte('=')
-		sb.WriteString(shellescape(v))
+		sb.WriteString(shellescape(c.EnvVars[k]))
 		sb.WriteByte(' ')
 	}
 	return sb.String()