Port envd from e2b with internalized shared packages and Connect RPC

- Copy envd source from e2b-dev/infra, internalize shared dependencies
  into envd/internal/shared/ (keys, filesystem, id, smap, utils)
- Switch from gRPC to Connect RPC for all envd services
- Update module paths to git.omukk.dev/wrenn/{sandbox,sandbox/envd}
- Add proto specs (process, filesystem) with buf-based code generation
- Implement full envd: process exec, filesystem ops, port forwarding,
  cgroup management, MMDS integration, and HTTP API
- Update main module dependencies (firecracker SDK, pgx, goose, etc.)
- Remove placeholder .gitkeep files replaced by real implementations

envd/internal/services/filesystem/move.go

@@ -0,0 +1,58 @@
+package filesystem
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"connectrpc.com/connect"
+
+	"git.omukk.dev/wrenn/sandbox/envd/internal/permissions"
+	rpc "git.omukk.dev/wrenn/sandbox/envd/internal/services/spec/filesystem"
+)
+
+func (s Service) Move(ctx context.Context, req *connect.Request[rpc.MoveRequest]) (*connect.Response[rpc.MoveResponse], error) {
+	u, err := permissions.GetAuthUser(ctx, s.defaults.User)
+	if err != nil {
+		return nil, err
+	}
+
+	source, err := permissions.ExpandAndResolve(req.Msg.GetSource(), u, s.defaults.Workdir)
+	if err != nil {
+		return nil, connect.NewError(connect.CodeInvalidArgument, err)
+	}
+
+	destination, err := permissions.ExpandAndResolve(req.Msg.GetDestination(), u, s.defaults.Workdir)
+	if err != nil {
+		return nil, connect.NewError(connect.CodeInvalidArgument, err)
+	}
+
+	uid, gid, userErr := permissions.GetUserIdInts(u)
+	if userErr != nil {
+		return nil, connect.NewError(connect.CodeInternal, userErr)
+	}
+
+	userErr = permissions.EnsureDirs(filepath.Dir(destination), uid, gid)
+	if userErr != nil {
+		return nil, connect.NewError(connect.CodeInternal, userErr)
+	}
+
+	err = os.Rename(source, destination)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("source file not found: %w", err))
+		}
+
+		return nil, connect.NewError(connect.CodeInternal, fmt.Errorf("error renaming: %w", err))
+	}
+
+	entry, err := entryInfo(destination)
+	if err != nil {
+		return nil, err
+	}
+
+	return connect.NewResponse(&rpc.MoveResponse{
+		Entry: entry,
+	}), nil
+}