…surfaces 2-4)

Adds the remaining three Class A operations (clone, export, import) over
the REST chain, following the same template PR boxlite-ai#694 established for
snapshot. Pre-fix the SDK Rust REST client short-circuited each call
with "Remote server does not support {clone,export,import} operations"
because the API's /v1/config returned those capabilities as false.

Layers:

  - sdks/c/src/clone_export.rs (new)
      `boxlite_box_clone_box` (returns CBoxHandle), `boxlite_box_export`
      (unit + error; caller already knows dest path),
      `boxlite_runtime_import_box` (returns CBoxHandle). Each async +
      callback, mirroring snapshot.rs.
  - sdks/c/src/event_queue.rs
      2 new RuntimeEvent variants (CloneBox uses OwnedFfiPtr<CBoxHandle>,
      ExportBox is unit) + 2 callback function types.
  - sdks/c/src/lib.rs / runtime.rs
      Register the module + dispatch through existing
      dispatch_handle_event / dispatch_unit_event paths.
  - sdks/go/clone_export.go (new) + bridge.{c,h}
      Box.CloneBox, Box.Export, Runtime.ImportBox + cgo bridge.
  - apps/runner/pkg/boxlite/client.go
      Client.CloneBox, Client.ExportBox, Client.ImportBox.
  - apps/runner/pkg/api/controllers/boxlite_clone_export.go (new)
      3 gin handlers + classifyCloneExportError. Export streams the
      archive bytes back to the SDK as the response body (the SDK
      writes to its caller-chosen host path). Import reads bytes from
      the request body, writes to a runner-local temp file, then calls
      ImportBox.
  - apps/runner/pkg/api/server.go
      3 new routes (POST /clone, POST /export, POST /import).
  - apps/api/src/boxlite-rest/boxlite-proxy.controller.ts
      Proxy routes for /clone, /export, and the runtime-level /import.
      Import has no boxId so it's routed via `pickRunnerForImport`
      (any runner the org has a sandbox on). If the org has no
      existing sandbox, returns 404 with an explanatory message.
  - apps/api/src/boxlite-rest/boxlite-config.controller.ts
      Flips `clone_enabled / export_enabled / import_enabled = true`
      so the SDK's `require_*_enabled` gates stop short-circuiting.

E2E status:

The REST plumbing is **verified end-to-end** — the SDK calls now reach
libboxlite on the runner instead of hitting the "Remote server does not
support" gate. With the e2e test stack:

  test_clone_box_yields_independent_disk:
    PRE  : RuntimeError: "Remote server does not support clone
           operations"  (SDK short-circuit)
    POST : HTTP 500 "clone failed: boxlite: internal error:
           Failed to SIGSTOP shim process (pid=…): Connection refused"
           (libkrun/libboxlite-side issue, identical signature to the
           snapshot pre-existing failure)

  test_export_import_roundtrip:
    PRE  : RuntimeError: "Remote server does not support export
           operations"  (SDK short-circuit)
    POST : HTTP 500 "export failed: boxlite: internal error:
           Failed to SIGSTOP shim process …"

The SIGSTOP failure is a libboxlite snapshot mechanism issue
reproducible against local FFI on the same EC2 host — the same one
PR boxlite-ai#694 documented. Out of scope for this REST surface PR.

Branched off fix/rest-snapshot-end-to-end (boxlite-ai#694) — depends on the
snapshot baseline + cbindgen header refresh landing first.