Add host agent RPC server with sandbox lifecycle management

Implement the host agent as a Connect RPC server that orchestrates
sandbox creation, destruction, pause/resume, and command execution.
Includes sandbox manager with TTL-based reaper, network slot allocator,
rootfs cloning, hostagent proto definition with generated stubs, and
test/debug scripts. Fix Firecracker process lifetime bug where VM was
tied to HTTP request context instead of background context.

internal/vm/jailer.go

@@ -30,7 +30,10 @@ type process struct {
 //  5. ip netns exec <ns>: enters the network namespace where TAP is configured
 //  6. exec firecracker with the API socket path
 func startProcess(ctx context.Context, cfg *VMConfig) (*process, error) {
-	execCtx, cancel := context.WithCancel(ctx)
+	// Use a background context for the long-lived Firecracker process.
+	// The request context (ctx) is only used for the startup phase — we must
+	// not tie the VM's lifetime to the HTTP request that created it.
+	execCtx, cancel := context.WithCancel(context.Background())
 
 	script := buildStartScript(cfg)