kvm2: stop handing go-libvirt a reader that can error (H2)

uploadImage streamed the HTTP body straight into StorageVolUpload. When
that body failed part way through, go-libvirt deadlocked: requestStream
starts its stream sender on two unbuffered channels and, on the error
path, returns without ever reading outErr, so SendStream emits a
StatusError packet and parks on `outErr <-` forever while the main
goroutine parks on `abort <- true` forever. StorageVolUpload never
returned. The 20-minute transfer budget rescued the caller only, and the
socket kill did nothing, because both ends are blocked on channel sends
rather than on I/O -- which is what the comment at backend.go:152 got
wrong. Each failed upload leaked kvm2's call goroutine, go-libvirt's
sender goroutine and a 4 MiB buffer, permanently, against a 128Mi pod
limit and a reconciler that retries on backoff.

The defect is upstream and stays there: no fork, no replace. Instead
eofReader, at the go-libvirt seam so it covers the seed and marker
uploads too, converts any source error to io.EOF -- the one outcome that
ends a stream the normal way -- and keeps the real error for the caller.
countingReader sits underneath untouched, so the existing length and
digest checks report exactly what they did before.

The download also gets its own deadline a minute inside the transfer
budget. fetchImage already bounded the whole fetch at 20 minutes, so the
body's death and the budget's socket kill were racing and the socket
usually won; with the body a minute ahead, a stalled mirror ends through
its reader and unwinds cleanly instead of leaking.

discardVolume moves from uploadImage into fetchImage's upload-error
branch, so the dedicated connection is closed and libvirtd has let go of
the stream's fd before the file is unlinked. Moving it rather than adding
a second Close keeps image_test's closeCount() == 1 true. That discard is
still unfenced against a second provider entry sharing the volume name;
H4 closes that by making the name per-entry.

What remains: a failure originating in libvirtd mid-upload still leaks,
since SendStream has already returned by then. Confirmed unfixable from
here. Known gaps quotes the two-character upstream fix
(make(chan bool, 1) / make(chan error, 1)) and the replace escape hatch.

Unverified at ~85%: that libvirtd answers a short-but-clean stream finish
with OK rather than an error. virFDStreamWrite enforces length only on
writes past it and nothing compares offset to length on the close path,
which is also why virsh vol-upload of a small file into a large volume
works. If it errors we are back to a deadlock by a different door, which
is exactly today's behaviour, so this cannot be worse. The execution file
carries a probe recipe to settle it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

internal/provider/kvm2/backend_test.go

@@ -3,6 +3,7 @@ package kvm2
 import (
 	"context"
 	"errors"
+	"io"
 	"strings"
 	"sync/atomic"
 	"testing"
@@ -213,6 +214,57 @@ func TestMarkDead_slowKillDoesNotBlockCallers(t *testing.T) {
 	}
 }
 
+// TestEOFReader_sourceErrorNeverReachesTheStream pins the one property the
+// upload seam needs: go-libvirt's stream sender must never see an error
+// other than io.EOF, because it answers one by parking forever on a channel
+// nothing reads. The real error has to survive for the caller.
+func TestEOFReader_sourceErrorNeverReachesTheStream(t *testing.T) {
+	t.Parallel()
+	boom := errors.New("connection reset by peer")
+	tests := []struct {
+		name    string
+		reader  io.Reader
+		wantN   int
+		wantErr error
+	}{
+		{name: "error after data", reader: io.MultiReader(strings.NewReader("abc"), errReader{boom}), wantN: 3, wantErr: boom},
+		{name: "error with no data", reader: errReader{boom}, wantErr: boom},
+		{name: "clean eof passes through", reader: strings.NewReader("abc"), wantN: 3},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			e := &eofReader{r: tc.reader}
+			n, err := io.Copy(io.Discard, e)
+			if err != nil {
+				t.Fatalf("io.Copy through eofReader = %v, want nil: the stream sender must only ever see io.EOF", err)
+			}
+			if n != int64(tc.wantN) {
+				t.Errorf("copied %d bytes, want %d", n, tc.wantN)
+			}
+			if !errors.Is(e.sourceErr(), tc.wantErr) {
+				t.Errorf("sourceErr() = %v, want %v", e.sourceErr(), tc.wantErr)
+			}
+		})
+	}
+}
+
+func TestEOFReader_keepsTheFirstError(t *testing.T) {
+	t.Parallel()
+	first, second := errors.New("first"), errors.New("second")
+	e := &eofReader{r: io.MultiReader(errReader{first}, errReader{second})}
+	if _, err := io.Copy(io.Discard, e); err != nil {
+		t.Fatalf("io.Copy through eofReader = %v, want nil", err)
+	}
+	if !errors.Is(e.sourceErr(), first) {
+		t.Errorf("sourceErr() = %v, want the first error", e.sourceErr())
+	}
+}
+
+type errReader struct{ err error }
+
+func (r errReader) Read([]byte) (int, error) { return 0, r.err }
+
 func TestBudgets_upload(t *testing.T) {
 	t.Parallel()
 	tests := []struct {