provider: extract nocloud seed builder and keyedlock from kvm2

kvm2's NoCloud seed builder moves to internal/provider/nocloud (exported,
with an ErrEmptyName sentinel instead of permanentf) and its keyed locks
to internal/provider/keyedlock, tests moved under their existing names.
kvm2 behaviour is unchanged. proxmox gains the per-name lock and the pure
seed helpers (seedISOName, seedVolID, buildSeed); unlike kvm2 (review
finding S5.1), a seed staging failure there is Transient, not Permanent.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/provider/kvm2/kvm2.go

@@ -9,13 +9,13 @@ import (
 	"fmt"
 	"net/http"
 	"os"
-	"sync"
 	"time"
 
 	"github.com/go-logr/logr"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
 
 	"gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator/internal/provider"
+	"gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator/internal/provider/keyedlock"
 	"gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator/internal/tracing"
 )
 
@@ -41,12 +41,12 @@ type Provider struct {
 	runningPoll time.Duration
 
 	// imageLocks serialises image fetches per (host, volume), spec entry 19.
-	imageLocks *keyedLocks
+	imageLocks *keyedlock.Locks
 
 	// nameLocks serialises Create and Delete per instance name, spec entry
 	// 19, so two Deletes never race on destroy and undefine and a Delete
 	// cannot interleave with a Create's steps.
-	nameLocks *keyedLocks
+	nameLocks *keyedlock.Locks
 }
 
 // providerOption adjusts what newProvider builds; tests inject an HTTP
@@ -111,8 +111,8 @@ func newProvider(name string, cfg provider.KVMConfig, d dialer, opts ...provider
 		http:        http.DefaultClient,
 		runningWait: defaultRunningWait,
 		runningPoll: defaultRunningPoll,
-		imageLocks:  newKeyedLocks(),
-		nameLocks:   newKeyedLocks(),
+		imageLocks:  keyedlock.New(),
+		nameLocks:   keyedlock.New(),
 	}
 	for _, opt := range opts {
 		opt(p)
@@ -187,60 +187,9 @@ func (p *Provider) wrapErr(op, id string, err error) error {
 // so a caller whose ctx ends while another caller's Create is downloading
 // an image returns promptly.
 func (p *Provider) lockName(ctx context.Context, name string) (func(), error) {
-	release, err := p.nameLocks.acquire(ctx, name)
+	release, err := p.nameLocks.Acquire(ctx, name)
 	if err != nil {
 		return nil, fmt.Errorf("%w: waiting for the lock on %s: %w", provider.ErrTransient, name, err)
 	}
 	return release, nil
 }
-
-// keyedLocks is a set of one-slot semaphores by key (spec entry 19): a
-// semaphore rather than a mutex so a waiter can give up with its ctx. Each
-// entry counts the callers holding or waiting for it and is dropped from
-// the map at zero, so the map does not grow with every name ever seen while
-// two waiters on one key still always share one semaphore.
-type keyedLocks struct {
-	mu    sync.Mutex
-	locks map[string]*keyedLock
-}
-
-type keyedLock struct {
-	sem  chan struct{}
-	refs int
-}
-
-func newKeyedLocks() *keyedLocks {
-	return &keyedLocks{locks: make(map[string]*keyedLock)}
-}
-
-// acquire takes the lock for key, or gives up with ctx's error. The
-// returned func releases it and must be called exactly once.
-func (k *keyedLocks) acquire(ctx context.Context, key string) (func(), error) {
-	k.mu.Lock()
-	l, ok := k.locks[key]
-	if !ok {
-		l = &keyedLock{sem: make(chan struct{}, 1)}
-		k.locks[key] = l
-	}
-	l.refs++
-	k.mu.Unlock()
-	select {
-	case l.sem <- struct{}{}:
-		return func() {
-			<-l.sem
-			k.unref(key, l)
-		}, nil
-	case <-ctx.Done():
-		k.unref(key, l)
-		return nil, ctx.Err()
-	}
-}
-
-func (k *keyedLocks) unref(key string, l *keyedLock) {
-	k.mu.Lock()
-	defer k.mu.Unlock()
-	l.refs--
-	if l.refs == 0 {
-		delete(k.locks, key)
-	}
-}