Add sandbox snapshot and restore with UFFD lazy memory loading

Implement full snapshot lifecycle: pause (snapshot + free resources),
resume (UFFD-based lazy restore), and named snapshot templates that
can spawn new sandboxes from frozen VM state.

Key changes:
- Snapshot header system with generational diff mapping (inspired by e2b)
- UFFD server for lazy page fault handling during snapshot restore
- Stable rootfs symlink path (/tmp/fc-vm/) for snapshot compatibility
- Templates DB table and CRUD API endpoints (POST/GET/DELETE /v1/snapshots)
- CreateSnapshot/DeleteSnapshot RPCs in hostagent proto
- Reconciler excludes paused sandboxes (expected absent from host agent)
- Snapshot templates lock vcpus/memory to baked-in values
- Proper cleanup of uffd sockets and pause snapshot files on destroy

envd/internal/api/init_test.go

@@ -16,9 +16,9 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"git.omukk.dev/wrenn/sandbox/envd/internal/execcontext"
-	"git.omukk.dev/wrenn/sandbox/envd/internal/utils"
 	"git.omukk.dev/wrenn/sandbox/envd/internal/shared/keys"
 	utilsShared "git.omukk.dev/wrenn/sandbox/envd/internal/shared/utils"
+	"git.omukk.dev/wrenn/sandbox/envd/internal/utils"
 )
 
 func TestSimpleCases(t *testing.T) {