kvm2: apply the milestone review

Shorter start wait with immediate verdicts for dead or paused domains,
ListByTag without state or address RPCs, Timeout for an expired check
round, no adoption of unmarked domains, reference-counted keyed locks,
dead options removed, HEAD fallback on any non-2xx.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/plans-executions/2026-09-16-1333-kvm2-provider.md

@@ -12,7 +12,7 @@ Plan: [docs/plans/2026-09-16-1333-kvm2-provider.md](../plans/2026-09-16-1333-kvm
 - [x] Step 7 — Checker and the CRD comment
 - [x] Step 8 — Deployment files, Makefile, integration test
 - [x] Step 9 — Documentation
-- [ ] Step 10 — Milestone review
+- [x] Step 10 — Milestone review
 - [ ] Step 11 — Real-host validation, changelog, MR
 
 ## Step 0 — Plan file and branch
@@ -338,3 +338,45 @@ resolves. The one added em-dash is the `Leader-elected` cell of the new
 components-table row, where the table's own convention wins.
 
 Attestation: "files read outside the allowed set: none".
+
+## Step 10 — Milestone review
+
+2026-09-16 21:19. The `go-operator-reviewer` agent reviewed the package
+against the contract and the spec (v1 code off limits to it as well) and
+returned seven findings, all accepted and applied by a fresh fix agent in
+one commit with regression tests:
+
+1. `waitRunning`'s two-minute cap only ever elapsed in the bad cases and
+   pinned a reconcile worker; now 15 s, a domain that dies right after
+   start is Transient at once, and a paused or pmsuspended domain is
+   Permanent before `DomainCreate` (an admin's doing).
+2. `ListByTag` read state and addresses that GC never uses, one agent RPC
+   per active domain per sweep; it now builds instances from the name and
+   the metadata only (`TestListByTag_doesNotReadStateOrAddresses`).
+3. A health round that ran out of time was blamed on the host
+   (`Unreachable`); `checkHost` now reports `Timeout` whenever the round's
+   ctx ended, whichever dial stage was running, and the promptness test
+   uses the production error shape.
+4. `Create` adopted an unmarked domain and never wrote the mark, so GC could
+   not see it; an unmarked domain under the name is now Permanent
+   (`TestCreate_adoptsOnlyMarkedDomains`).
+5. `hostTable.closeAll` had no production caller and `withBudgets` could not
+   work (the dialer captured the defaults first); both removed.
+6. The per-name and per-image lock maps grew without bound; replaced by a
+   reference-counted `keyedLocks` whose entries vanish when uncontended.
+7. `imageSizeIfUncached` falls back to GET on any non-2xx HEAD, and two
+   Delete no-op lines moved from V(0) to V(1).
+
+The spec (entries 2, 10, 12, 16, 18, 19, 24), the guide, the appendix and
+the architecture flow were updated in the same commit. The reviewer also
+listed what it checked and found correct: the error boundary, the state
+rules, Delete's idempotency and the replacement window, ListByTag's
+partial-failure policy, the abandon policy and double-close guards,
+resource handling on every path, and secret hygiene in the format strings.
+
+Lint: `bin/golangci-lint` still panics on this toolchain (Go 1.27 against
+a staticcheck built for 1.26), reproducible on untouched packages, so
+`make lint` could not gate this step; `go vet` with every build tag is
+clean. Tests: `go test -race -count=3 ./internal/provider/kvm2/` (168
+top-level tests) and `go test -short ./...` pass; `make test` with envtest
+runs next.