Add host agent RPC server with sandbox lifecycle management

Implement the host agent as a Connect RPC server that orchestrates
sandbox creation, destruction, pause/resume, and command execution.
Includes sandbox manager with TTL-based reaper, network slot allocator,
rootfs cloning, hostagent proto definition with generated stubs, and
test/debug scripts. Fix Firecracker process lifetime bug where VM was
tied to HTTP request context instead of background context.

internal/network/allocator.go

@@ -1 +1,41 @@
 package network
+
+import (
+	"fmt"
+	"sync"
+)
+
+// SlotAllocator manages network slot indices for sandboxes.
+// Each sandbox needs a unique slot index for its network addressing.
+type SlotAllocator struct {
+	mu    sync.Mutex
+	inUse map[int]bool
+}
+
+// NewSlotAllocator creates a new slot allocator.
+func NewSlotAllocator() *SlotAllocator {
+	return &SlotAllocator{
+		inUse: make(map[int]bool),
+	}
+}
+
+// Allocate returns the next available slot index (1-based).
+func (a *SlotAllocator) Allocate() (int, error) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+
+	for i := 1; i <= 65534; i++ {
+		if !a.inUse[i] {
+			a.inUse[i] = true
+			return i, nil
+		}
+	}
+	return 0, fmt.Errorf("no free network slots")
+}
+
+// Release frees a slot index for reuse.
+func (a *SlotAllocator) Release(index int) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	delete(a.inUse, index)
+}