Add host agent RPC server with sandbox lifecycle management

Implement the host agent as a Connect RPC server that orchestrates
sandbox creation, destruction, pause/resume, and command execution.
Includes sandbox manager with TTL-based reaper, network slot allocator,
rootfs cloning, hostagent proto definition with generated stubs, and
test/debug scripts. Fix Firecracker process lifetime bug where VM was
tied to HTTP request context instead of background context.

CLAUDE.md

@@ -770,8 +770,8 @@ open http://localhost:8000/admin/
 1. Write `internal/network/` — TAP + NAT per sandbox
 2. Write `internal/filesystem/` — CoW rootfs clones
 3. Define hostagent.proto, generate stubs
-4. Write host agent gRPC server
-5. Test: grpcurl to create/exec/destroy
+4. Write host agent rpc server
+5. Test: curl to create/exec/destroy
 
 ### Phase 3: Control Plane
 1. Set up PostgreSQL, write goose migrations