Load the KVM ssh material on first use instead of at startup

The kvm-ssh Secret is mounted optional, but kvm.New read the key and
known_hosts eagerly and registry.Build aborts the whole provider set on a
constructor error, so a missing or misnamed Secret exited the manager
before any controller started and took the kubernetes and gcp providers
down with it.

lazyAuth loads the material on the first connection and caches it once it
works, so a Secret created after the manager starts heals the affected
proxies on the next reconcile with no restart. A missing file classifies
transient for that reason; a key that does not parse is permanent.

New still checks both files and logs a WARNING: line when they are
unreadable, keeping the startup diagnostic the eager load was there for.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

internal/provider/kvm/kvm.go

@@ -77,18 +77,22 @@ type Provider struct {
 }
 
 // New builds a Provider that reaches its hosts over SSH. The key and
-// known_hosts files are read here so a bad path fails at startup rather
-// than on the first Create. Satisfies registry.Constructor.
-func New(_ context.Context, pc provider.ProviderConfig) (provider.Provider, error) {
+// known_hosts files are read on the first connection, not here: they come
+// from an optional Secret mount, and a constructor that failed without it
+// would abort the whole provider set and crash-loop the manager, taking
+// the kubernetes and gcp providers down with it. Unreadable files are
+// still reported at startup, as a warning. Satisfies registry.Constructor.
+func New(ctx context.Context, pc provider.ProviderConfig) (provider.Provider, error) {
 	cfg := provider.KVMConfig{}
 	if pc.KVM != nil {
 		cfg = *pc.KVM
 	}
-	auth, err := newSSHAuth(cfg)
-	if err != nil {
-		return nil, fmt.Errorf("kvm provider %q: %w", pc.Name, err)
+	if _, err := newSSHAuth(cfg); err != nil {
+		logf.FromContext(ctx).WithName("kvm").WithValues("provider", pc.Name).Info(
+			"WARNING: kvm ssh material is not usable; proxies on this provider will fail until it is",
+			"error", err.Error())
 	}
-	return newWithDialer(pc, auth.dialer(), nil), nil
+	return newWithDialer(pc, lazyDialer(cfg), nil), nil
 }
 
 // newWithDialer is the test seam: the dialer decides what libvirtAPI each