provider: extract nocloud seed builder and keyedlock from kvm2

kvm2's NoCloud seed builder moves to internal/provider/nocloud (exported,
with an ErrEmptyName sentinel instead of permanentf) and its keyed locks
to internal/provider/keyedlock, tests moved under their existing names.
kvm2 behaviour is unchanged. proxmox gains the per-name lock and the pure
seed helpers (seedISOName, seedVolID, buildSeed); unlike kvm2 (review
finding S5.1), a seed staging failure there is Transient, not Permanent.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/kvm2-provider.md

@@ -252,7 +252,8 @@ UIDs, and a marked domain with a matching or empty `uid` is adopted. The
 namespace is kvm2's own, so the `kvm` provider's domains are invisible to
 it (see *Migrating from kvm*).
 
-The seed (`buildSeedISO` in `seed.go`) is an ISO 9660 image labelled
+The seed (`nocloud.BuildSeedISO`, shared with the proxmox provider in
+`internal/provider/nocloud`) is an ISO 9660 image labelled
 `cidata` with three files. `user-data` is the Proxy's `cloudInit`, **byte
 for byte**: any format cloud-init accepts works, including a Jinja
 template, a MIME archive, a shell script or a gzipped payload; the
@@ -267,7 +268,7 @@ previous attempt may have been cut off mid-upload and a truncated seed
 would boot a VM without cloud-init.
 
 The guest agent rides along in `vendor-data` as a **shell script**
-(`guestAgentScript` in `seed.go`), not a cloud-config, on purpose:
+(`nocloud.GuestAgentScript`), not a cloud-config, on purpose:
 cloud-init merges a vendor-data cloud-config under the user-data with
 mergers that keep the user-data's value for every top-level key both
 define and never append lists, so a Proxy carrying its own `packages:`