kvm2: apply the milestone review

Shorter start wait with immediate verdicts for dead or paused domains,
ListByTag without state or address RPCs, Timeout for an expired check
round, no adoption of unmarked domains, reference-counted keyed locks,
dead options removed, HEAD fallback on any non-2xx.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/provider/kvm2/hosts_test.go

@@ -176,23 +176,6 @@ func TestHosts_dialErrorIsNotCached(t *testing.T) {
 	}
 }
 
-func TestHosts_closeAll(t *testing.T) {
-	t.Parallel()
-	table := newHostTable(&stubDialer{fresh: func() backend { return newFakeBackend() }})
-	a, _ := table.get(context.Background(), hostA)
-	b, _ := table.get(context.Background(), hostB)
-	if err := table.closeAll(); err != nil {
-		t.Fatalf("closeAll error = %v", err)
-	}
-	if a.(*fakeBackend).closed != 1 || b.(*fakeBackend).closed != 1 {
-		t.Errorf("closed counts = %d, %d, want 1, 1", a.(*fakeBackend).closed, b.(*fakeBackend).closed)
-	}
-	again, _ := table.get(context.Background(), hostA)
-	if again == a {
-		t.Error("get after closeAll returned the closed backend")
-	}
-}
-
 // perHostDialer routes each host to its own stub.
 type perHostDialer map[string]*stubDialer