provider: extract nocloud seed builder and keyedlock from kvm2

kvm2's NoCloud seed builder moves to internal/provider/nocloud (exported,
with an ErrEmptyName sentinel instead of permanentf) and its keyed locks
to internal/provider/keyedlock, tests moved under their existing names.
kvm2 behaviour is unchanged. proxmox gains the per-name lock and the pure
seed helpers (seedISOName, seedVolID, buildSeed); unlike kvm2 (review
finding S5.1), a seed staging failure there is Transient, not Permanent.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/provider/proxmox/proxmox_test.go

@@ -206,3 +206,24 @@ func TestStubs_answerTransient(t *testing.T) {
 		}
 	}
 }
+
+func TestLockName_givesUpWithContextAsTransient(t *testing.T) {
+	t.Parallel()
+	p := newProvider("proxmox-home", testConfig(), nil)
+	release, err := p.lockName(context.Background(), "proxy-abc")
+	if err != nil {
+		t.Fatalf("lockName error = %v", err)
+	}
+	defer release()
+	other, err := p.lockName(context.Background(), "proxy-def")
+	if err != nil {
+		t.Fatalf("lockName on another name error = %v, want it free", err)
+	}
+	other()
+	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Millisecond)
+	defer cancel()
+	_, err = p.lockName(ctx, "proxy-abc")
+	if !errors.Is(err, provider.ErrTransient) || !errors.Is(err, context.DeadlineExceeded) {
+		t.Errorf("lockName on a held name error = %v, want ErrTransient wrapping DeadlineExceeded", err)
+	}
+}