kvm2: apply the milestone review

Shorter start wait with immediate verdicts for dead or paused domains,
ListByTag without state or address RPCs, Timeout for an expired check
round, no adoption of unmarked domains, reference-counted keyed locks,
dead options removed, HEAD fallback on any non-2xx.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/provider/kvm2/fake_test.go

@@ -36,10 +36,13 @@ type fakeBackend struct {
 	// sha256 in fixed chunks instead of holding the bytes, for tests that
 	// push more through the fake than they want in memory.
 	discardUploads bool
-	// startDelayPolls, when set, makes DomainCreate leave the domain shut
-	// off; it turns running on the startDelayPolls-th DomainGetState after
-	// that, as a real host that is still booting QEMU would.
+	// startDelayPolls, when set, makes DomainCreate leave the domain in
+	// nostate; it turns running on the startDelayPolls-th DomainGetState
+	// after that, as a host whose QEMU is still settling would.
 	startDelayPolls int
+	// stateAfterStart, when not nostate, is what DomainCreate leaves the
+	// domain in instead of running, as a guest that dies at once would.
+	stateAfterStart libvirt.DomainState
 	// undefineFlags records the flags of the last DomainUndefineFlags per
 	// domain name.
 	undefineFlags map[string]libvirt.DomainUndefineFlagsValues
@@ -291,9 +294,14 @@ func (f *fakeBackend) DomainCreate(ctx context.Context, dom libvirt.Domain) erro
 	if isActive(d.state) {
 		return fakeErr(libvirt.ErrOperationInvalid, "Requested operation is not valid: domain is already running")
 	}
-	if f.startDelayPolls > 0 {
+	switch {
+	case f.startDelayPolls > 0:
+		d.state = libvirt.DomainNostate
 		d.pendingStart = f.startDelayPolls
 		return nil
+	case f.stateAfterStart != libvirt.DomainNostate:
+		d.state = f.stateAfterStart
+		return nil
 	}
 	d.state = libvirt.DomainRunning
 	d.id = int32(len(f.domains))