Add minimal control plane with REST API, database, and reconciler

- REST API (chi router): sandbox CRUD, exec, pause/resume, file write/read
- PostgreSQL persistence via pgx/v5 + sqlc (sandboxes table with goose migration)
- Connect RPC client to host agent for all VM operations
- Reconciler syncs host agent state with DB every 30s (detects TTL-reaped sandboxes)
- OpenAPI 3.1 spec served at /openapi.yaml, Swagger UI at /docs
- Added WriteFile/ReadFile RPCs to hostagent proto and implementations
- File upload via multipart form, download via JSON body POST
- sandbox_id propagated from control plane to host agent on create

proto/envd/gen/filesystem.pb.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.36.11

proto/envd/gen/genconnect/filesystem.connect.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+
 // Code generated by protoc-gen-connect-go. DO NOT EDIT.
 //
 // Source: filesystem.proto

proto/envd/gen/genconnect/process.connect.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+
 // Code generated by protoc-gen-connect-go. DO NOT EDIT.
 //
 // Source: process.proto

proto/envd/gen/process.pb.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.36.11