kvm2: apply the milestone review

Shorter start wait with immediate verdicts for dead or paused domains,
ListByTag without state or address RPCs, Timeout for an expired check
round, no adoption of unmarked domains, reference-counted keyed locks,
dead options removed, HEAD fallback on any non-2xx.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/architecture.md

@@ -172,7 +172,8 @@ closes the SSH connection to unblock it.
 
 kvm2 provider (internal/provider/kvm2/) - the same transport, a second type built from the contract
 prov.Create ──► placement checked against the catalogue (Permanent before any dial)
-                DomainLookupByName: exists → uid guard (foreign uid = Permanent),  ─┐ every step
+                DomainLookupByName: exists → mark+uid guard (no mark or foreign   ─┐ every step
+                  uid = Permanent; paused = Permanent),                            │
                   start if needed, wait for running, done                          │ idempotent,
                 else: StoragePoolGetInfo precheck: image (if uncached) + diskSizeGb │ under a
                         + 16 MiB must fit, else ErrQuotaExceeded (reconciler       │ per-name lock
@@ -184,7 +185,7 @@ prov.Create ──► placement checked against the catalogue (Permanent before
                       seed ISO (always rebuilt)                                    │
                       DomainDefineXML (<metadata> in kvm2's own namespace:         │
                         managed, uid, createdAt) + DomainCreate, poll until        │
-                        running (2m cap)                                          ─┘
+                        running (15s cap; a domain that dies at once = Transient) ─┘
 prov.Get    ──► DomainLookupByName + DomainGetMetadata + DomainGetState
                   + DomainInterfaceAddresses (guest agent, then ARP; first routable IPv4)
                   running without IP = Provisioning; nostate = Provisioning;