kvm2: apply the milestone review

Shorter start wait with immediate verdicts for dead or paused domains,
ListByTag without state or address RPCs, Timeout for an expired check
round, no adoption of unmarked domains, reference-counted keyed locks,
dead options removed, HEAD fallback on any non-2xx.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/provider/kvm2/hosts.go

@@ -2,7 +2,6 @@ package kvm2
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"sync"
 	"time"
@@ -93,26 +92,6 @@ func (t *hostTable) dialFresh(ctx context.Context, host provider.KVMHost) (backe
 	return t.dialer.dial(ctx, host)
 }
 
-// closeAll closes every pooled connection, waiting for in-flight dials.
-func (t *hostTable) closeAll() error {
-	t.mu.Lock()
-	entries := make([]*hostEntry, 0, len(t.hosts))
-	for _, e := range t.hosts {
-		entries = append(entries, e)
-	}
-	t.mu.Unlock()
-	var errs []error
-	for _, e := range entries {
-		e.sem <- struct{}{}
-		if e.backend != nil {
-			errs = append(errs, e.backend.Close())
-			e.backend = nil
-		}
-		<-e.sem
-	}
-	return errors.Join(errs...)
-}
-
 // libvirtDialer is the production dialer: SSH transport, go-libvirt over
 // the forwarded socket, the connect handshake, then the observe decorator,
 // so provider code never holds an undecorated backend.