Fix empty WRENN_TEMPLATE_ID after resuming paused sandbox

Resume() was building VMConfig without TemplateID, so Firecracker MMDS
received an empty string. envd's PostInit then wrote that empty value to
/run/wrenn/.WRENN_TEMPLATE_ID. Fix by persisting the template ID in
snapshot metadata during Pause and reading it back during Resume.

internal/sandbox/manager.go

@@ -577,6 +577,7 @@ func (m *Manager) Pause(ctx context.Context, sandboxID string) error {
 		// Record which base template this CoW was built against.
 		if err := snapshot.WriteMeta(pauseDir, "", &snapshot.RootfsMeta{
 			BaseTemplate: sb.baseImagePath,
+			TemplateID:   uuid.UUID(sb.TemplateID).String(),
 		}); err != nil {
 			warnErr("snapshot dir cleanup error", sandboxID, os.RemoveAll(pauseDir))
 			// VM and dm-snapshot are already gone — clean up remaining resources.
@@ -731,6 +732,7 @@ func (m *Manager) Resume(ctx context.Context, sandboxID string, timeoutSec int,
 	// Restore VM from snapshot.
 	vmCfg := vm.VMConfig{
 		SandboxID:        sandboxID,
+		TemplateID:       meta.TemplateID,
 		KernelPath:       m.resolveKernelPath(kernelVersion),
 		RootfsPath:       dmDev.DevicePath,
 		VCPUs:            1,                                         // Placeholder; overridden by snapshot.

internal/snapshot/local.go

@@ -64,6 +64,7 @@ func MetaPath(baseDir, name string) string {
 // RootfsMeta records which base template a CoW file was created against.
 type RootfsMeta struct {
 	BaseTemplate string `json:"base_template"`
+	TemplateID   string `json:"template_id,omitempty"`
 }
 
 // WriteMeta writes rootfs metadata to the snapshot directory.