Add streaming exec and file transfer endpoints

Add WebSocket-based streaming exec endpoint and streaming file
upload/download endpoints to the control plane API. Includes new
host agent RPC methods (ExecStream, StreamWriteFile, StreamReadFile),
envd client streaming support, and OpenAPI spec updates.

proto/hostagent/hostagent.proto

@@ -28,6 +28,16 @@ service HostAgentService {
 
   // ReadFile reads a file from inside a sandbox.
   rpc ReadFile(ReadFileRequest) returns (ReadFileResponse);
+
+  // ExecStream runs a command inside a sandbox and streams output events as they arrive.
+  rpc ExecStream(ExecStreamRequest) returns (stream ExecStreamResponse);
+
+  // WriteFileStream writes a file to a sandbox using chunked streaming.
+  // First message must contain metadata (sandbox_id, path). Subsequent messages contain data chunks.
+  rpc WriteFileStream(stream WriteFileStreamRequest) returns (WriteFileStreamResponse);
+
+  // ReadFileStream reads a file from a sandbox and streams it back in chunks.
+  rpc ReadFileStream(ReadFileStreamRequest) returns (stream ReadFileStreamResponse);
 }
 
 message CreateSandboxRequest {
@@ -120,3 +130,61 @@ message ReadFileRequest {
 message ReadFileResponse {
   bytes content = 1;
 }
+
+// ── Streaming Exec ──────────────────────────────────────────────────
+
+message ExecStreamRequest {
+  string sandbox_id = 1;
+  string cmd = 2;
+  repeated string args = 3;
+  int32 timeout_sec = 4;
+}
+
+message ExecStreamResponse {
+  oneof event {
+    ExecStreamStart start = 1;
+    ExecStreamData data = 2;
+    ExecStreamEnd end = 3;
+  }
+}
+
+message ExecStreamStart {
+  uint32 pid = 1;
+}
+
+message ExecStreamData {
+  oneof output {
+    bytes stdout = 1;
+    bytes stderr = 2;
+  }
+}
+
+message ExecStreamEnd {
+  int32 exit_code = 1;
+  string error = 2;
+}
+
+// ── Streaming File Transfer ─────────────────────────────────────────
+
+message WriteFileStreamRequest {
+  oneof content {
+    WriteFileStreamMeta meta = 1;
+    bytes chunk = 2;
+  }
+}
+
+message WriteFileStreamMeta {
+  string sandbox_id = 1;
+  string path = 2;
+}
+
+message WriteFileStreamResponse {}
+
+message ReadFileStreamRequest {
+  string sandbox_id = 1;
+  string path = 2;
+}
+
+message ReadFileStreamResponse {
+  bytes chunk = 1;
+}