kvm2: apply the milestone review

Shorter start wait with immediate verdicts for dead or paused domains,
ListByTag without state or address RPCs, Timeout for an expired check
round, no adoption of unmarked domains, reference-counted keyed locks,
dead options removed, HEAD fallback on any non-2xx.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/provider/kvm2/check.go

@@ -62,9 +62,15 @@ func (p *Provider) checkHost(ctx context.Context, host provider.KVMHost) provide
 		ts.Reason = provider.ReasonReachable
 	default:
 		var inactive *poolNotActiveError
-		if errors.As(err, &inactive) {
+		switch {
+		case ctx.Err() != nil:
+			// The round ran out of time, whichever stage was running: the
+			// error's shape (a dial that saw the ctx end, an abandoned
+			// call) says nothing the admin should act on.
+			ts.Reason = provider.ReasonTimeout
+		case errors.As(err, &inactive):
 			ts.Reason = reasonPoolNotActive
-		} else {
+		default:
 			ts.Reason = checkReason(err)
 		}
 		ts.Message = err.Error()
@@ -121,10 +127,11 @@ func (e *poolNotActiveError) Error() string {
 	return fmt.Sprintf("storage pool %q is %s", e.pool, e.state)
 }
 
-// checkReason maps a failed probe to a reason. A dial failure is judged by
-// its stage, so a TCP connect or an SSH handshake that ran out of time is
-// Unreachable, not Timeout: the host did not answer. Timeout is for ctx
-// ending or a budget expiring once the connection was up.
+// checkReason maps a failed probe to a reason once checkHost has ruled out
+// the round's ctx ending. A dial failure is judged by its stage, so a TCP
+// connect or an SSH handshake that ran out of the dial budget on its own is
+// Unreachable, not Timeout: the host did not answer. Timeout is for a
+// budget expiring once the connection was up.
 func checkReason(err error) string {
 	var de *dialError
 	if errors.As(err, &de) {