fix(sbx): make /sbx save work on a live multipass sandbox

Multipass can only snapshot a powered-off instance, so `/sbx save` on a
running multipass sandbox previously just surfaced multipass's "instance
must be stopped" error — making the snapshot that `/sbx load` needs
impossible to create through the UI.

Now multipass save powers the instance down before snapshotting, and the
handler tears the shared session down first (same as `/sbx stop`, but
WITHOUT purging so the instance — and thus the snapshot — survives for a
later `/sbx load`). Docker is unchanged: `docker commit` captures a live
container, so its save stays non-disruptive.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

hh/src/sbx.rs

@@ -589,6 +589,16 @@ pub fn save_state(backend: Backend, name: &str, label: &str, local: bool) -> Res
             Ok(format!("image {tag}"))
         }
         Backend::Multipass => {
+            // Multipass only snapshots a *stopped* instance (unlike docker, which
+            // commits a live container). Power it off first — the caller has
+            // already torn down the shared shell, so this is the save *and* stop.
+            // The instance stays registered (we don't purge), so `/sbx load` can
+            // restore the snapshot later.
+            let _ = Command::new("multipass")
+                .args(["stop", name])
+                .stdout(Stdio::null())
+                .stderr(Stdio::null())
+                .status();
             let out = Command::new("multipass")
                 .args(["snapshot", name, "--name", label])
                 .output()