Add sandbox snapshot and restore with UFFD lazy memory loading

Implement full snapshot lifecycle: pause (snapshot + free resources),
resume (UFFD-based lazy restore), and named snapshot templates that
can spawn new sandboxes from frozen VM state.

Key changes:
- Snapshot header system with generational diff mapping (inspired by e2b)
- UFFD server for lazy page fault handling during snapshot restore
- Stable rootfs symlink path (/tmp/fc-vm/) for snapshot compatibility
- Templates DB table and CRUD API endpoints (POST/GET/DELETE /v1/snapshots)
- CreateSnapshot/DeleteSnapshot RPCs in hostagent proto
- Reconciler excludes paused sandboxes (expected absent from host agent)
- Snapshot templates lock vcpus/memory to baked-in values
- Proper cleanup of uffd sockets and pause snapshot files on destroy

db/migrations/20260311224925_snapshots.sql

@@ -0,0 +1,14 @@
+-- +goose Up
+
+CREATE TABLE templates (
+    name         TEXT PRIMARY KEY,
+    type         TEXT NOT NULL DEFAULT 'base',        -- 'base' or 'snapshot'
+    vcpus        INTEGER,
+    memory_mb    INTEGER,
+    size_bytes   BIGINT NOT NULL DEFAULT 0,
+    created_at   TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+-- +goose Down
+
+DROP TABLE templates;

db/queries/templates.sql

@@ -0,0 +1,16 @@
+-- name: InsertTemplate :one
+INSERT INTO templates (name, type, vcpus, memory_mb, size_bytes)
+VALUES ($1, $2, $3, $4, $5)
+RETURNING *;
+
+-- name: GetTemplate :one
+SELECT * FROM templates WHERE name = $1;
+
+-- name: ListTemplates :many
+SELECT * FROM templates ORDER BY created_at DESC;
+
+-- name: ListTemplatesByType :many
+SELECT * FROM templates WHERE type = $1 ORDER BY created_at DESC;
+
+-- name: DeleteTemplate :exec
+DELETE FROM templates WHERE name = $1;