feat(sandbox): wire Sandbox entity end-to-end — persistence, orchestration, API, CLI

Implements the Sandbox as a first-class domain entity with full lifecycle:

Persistence (vz-stack):
- Add sandbox_state and allocator_state SQLite tables with CRUD methods
- Add AllocatorSnapshot for crash recovery of ports/IPs/mount offsets
- Add 5 sandbox event variants (Creating/Ready/Draining/Terminated/Failed)

Orchestration (vz-stack):
- ensure_sandbox() creates/reuses Sandbox entity per stack
- transition_sandbox_ready() after first successful execution
- teardown_sandbox() for graceful Ready→Draining→Terminated
- Wire RestartTracker into reconciliation loop
- Persist/restore allocator state across restarts

API (vz-api):
- Replace 501 stubs with real sandbox CRUD handlers
- POST /v1/sandboxes (create), GET /v1/sandboxes (list)
- GET /v1/sandboxes/{id} (inspect), DELETE /v1/sandboxes/{id} (terminate)
- Add server binary, integration tests

CLI (vz-cli):
- Add `vz sandbox list|inspect|terminate` subcommands
- Table and JSON output modes

Closes: vz-arp, vz-rhs, vz-f3c, vz-v2n.1.2

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: lightsofapollo

.beads/issues.jsonl

@@ -150,6 +150,9 @@ console = "0.15"
 ratatui = "0.29"
 crossterm = "0.28"
 
+# UUID
+uuid = { version = "1", features = ["v4"] }
+
 # Testing
 tempfile = "3"
 

crates/Cargo.lock

@@ -8,17 +8,22 @@ license.workspace = true
 repository.workspace = true
 
 [dependencies]
+anyhow = { workspace = true }
 async-stream = "0.3"
 axum = { version = "0.8", features = ["ws"] }
+clap = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
-tokio = { workspace = true, features = ["time"] }
+tokio = { workspace = true, features = ["macros", "net", "rt-multi-thread", "signal", "time"] }
 tokio-stream = { workspace = true }
 tracing = { workspace = true }
+tracing-subscriber = { workspace = true }
+uuid = { workspace = true }
 vz-runtime-contract = { workspace = true }
 vz-stack = { workspace = true }
 
 [dev-dependencies]
+reqwest = { workspace = true }
 tempfile = { workspace = true }
 tower = { workspace = true }
 vz-agent-proto = { workspace = true }