Port envd from e2b with internalized shared packages and Connect RPC

- Copy envd source from e2b-dev/infra, internalize shared dependencies
  into envd/internal/shared/ (keys, filesystem, id, smap, utils)
- Switch from gRPC to Connect RPC for all envd services
- Update module paths to git.omukk.dev/wrenn/{sandbox,sandbox/envd}
- Add proto specs (process, filesystem) with buf-based code generation
- Implement full envd: process exec, filesystem ops, port forwarding,
  cgroup management, MMDS integration, and HTTP API
- Update main module dependencies (firecracker SDK, pgx, goose, etc.)
- Remove placeholder .gitkeep files replaced by real implementations

envd/internal/services/filesystem/service.go

@@ -0,0 +1,34 @@
+package filesystem
+
+import (
+	"connectrpc.com/connect"
+	"github.com/go-chi/chi/v5"
+	"github.com/rs/zerolog"
+
+	"git.omukk.dev/wrenn/sandbox/envd/internal/execcontext"
+	"git.omukk.dev/wrenn/sandbox/envd/internal/logs"
+	spec "git.omukk.dev/wrenn/sandbox/envd/internal/services/spec/filesystem/filesystemconnect"
+	"git.omukk.dev/wrenn/sandbox/envd/internal/utils"
+)
+
+type Service struct {
+	logger   *zerolog.Logger
+	watchers *utils.Map[string, *FileWatcher]
+	defaults *execcontext.Defaults
+}
+
+func Handle(server *chi.Mux, l *zerolog.Logger, defaults *execcontext.Defaults) {
+	service := Service{
+		logger:   l,
+		watchers: utils.NewMap[string, *FileWatcher](),
+		defaults: defaults,
+	}
+
+	interceptors := connect.WithInterceptors(
+		logs.NewUnaryLogInterceptor(l),
+	)
+
+	path, handler := spec.NewFilesystemHandler(service, interceptors)
+
+	server.Mount(path, handler)
+}