kvm2: apply the milestone review

Shorter start wait with immediate verdicts for dead or paused domains,
ListByTag without state or address RPCs, Timeout for an expired check
round, no adoption of unmarked domains, reference-counted keyed locks,
dead options removed, HEAD fallback on any non-2xx.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/provider/kvm2/get.go

@@ -42,6 +42,8 @@ func (p *Provider) Get(ctx context.Context, providerID string) (*provider.Instan
 	return inst, nil
 }
 
+// get builds the Instance from the domain's metadata, its state and, for an
+// active domain, its discovered address.
 func get(ctx context.Context, log logr.Logger, be backend, hostName, name string) (*provider.Instance, error) {
 	dom, err := be.DomainLookupByName(ctx, name)
 	if err != nil {
@@ -51,11 +53,24 @@ func get(ctx context.Context, log logr.Logger, be backend, hostName, name string
 	if err != nil {
 		return nil, err
 	}
-	inst, err := inspect(ctx, log, be, hostName, dom, meta)
+	state, _, err := be.DomainGetState(ctx, dom, 0)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("reading state of domain %s: %w", dom.Name, err)
 	}
-	return &inst, nil
+	s := libvirt.DomainState(state)
+	var ip string
+	if isActive(s) {
+		if ip, err = address(ctx, log, be, dom); err != nil {
+			return nil, err
+		}
+	}
+	return &provider.Instance{
+		ID:        formatProviderID(hostName, dom.Name),
+		IP:        ip,
+		State:     mapState(s, ip),
+		UID:       meta.UID,
+		CreatedAt: meta.createdAt(),
+	}, nil
 }
 
 // readMetadata returns the kvm2 mark of a domain, or the zero value (not
@@ -72,29 +87,6 @@ func readMetadata(ctx context.Context, be backend, dom libvirt.Domain) (instance
 	return parseInstanceMetadata(raw)
 }
 
-// inspect builds the Instance from the backend's state and, for an active
-// domain, its discovered address.
-func inspect(ctx context.Context, log logr.Logger, be backend, hostName string, dom libvirt.Domain, meta instanceMetadata) (provider.Instance, error) {
-	state, _, err := be.DomainGetState(ctx, dom, 0)
-	if err != nil {
-		return provider.Instance{}, fmt.Errorf("reading state of domain %s: %w", dom.Name, err)
-	}
-	s := libvirt.DomainState(state)
-	var ip string
-	if isActive(s) {
-		if ip, err = address(ctx, log, be, dom); err != nil {
-			return provider.Instance{}, err
-		}
-	}
-	return provider.Instance{
-		ID:        formatProviderID(hostName, dom.Name),
-		IP:        ip,
-		State:     mapState(s, ip),
-		UID:       meta.UID,
-		CreatedAt: meta.createdAt(),
-	}, nil
-}
-
 // addressSources is the discovery order of spec entry 7: the guest agent
 // answers where the host's ARP table never sees guest traffic.
 var addressSources = []struct {