Port envd from e2b with internalized shared packages and Connect RPC

- Copy envd source from e2b-dev/infra, internalize shared dependencies
  into envd/internal/shared/ (keys, filesystem, id, smap, utils)
- Switch from gRPC to Connect RPC for all envd services
- Update module paths to git.omukk.dev/wrenn/{sandbox,sandbox/envd}
- Add proto specs (process, filesystem) with buf-based code generation
- Implement full envd: process exec, filesystem ops, port forwarding,
  cgroup management, MMDS integration, and HTTP API
- Update main module dependencies (firecracker SDK, pgx, goose, etc.)
- Remove placeholder .gitkeep files replaced by real implementations

envd/internal/services/process/signal.go

@@ -0,0 +1,38 @@
+package process
+
+import (
+	"context"
+	"fmt"
+	"syscall"
+
+	"connectrpc.com/connect"
+
+	rpc "git.omukk.dev/wrenn/sandbox/envd/internal/services/spec/process"
+)
+
+func (s *Service) SendSignal(
+	_ context.Context,
+	req *connect.Request[rpc.SendSignalRequest],
+) (*connect.Response[rpc.SendSignalResponse], error) {
+	handler, err := s.getProcess(req.Msg.GetProcess())
+	if err != nil {
+		return nil, err
+	}
+
+	var signal syscall.Signal
+	switch req.Msg.GetSignal() {
+	case rpc.Signal_SIGNAL_SIGKILL:
+		signal = syscall.SIGKILL
+	case rpc.Signal_SIGNAL_SIGTERM:
+		signal = syscall.SIGTERM
+	default:
+		return nil, connect.NewError(connect.CodeUnimplemented, fmt.Errorf("invalid signal: %s", req.Msg.GetSignal()))
+	}
+
+	err = handler.SendSignal(signal)
+	if err != nil {
+		return nil, connect.NewError(connect.CodeInternal, fmt.Errorf("error sending signal: %w", err))
+	}
+
+	return connect.NewResponse(&rpc.SendSignalResponse{}), nil
+}