kvm2: stop handing go-libvirt a reader that can error (H2)

uploadImage streamed the HTTP body straight into StorageVolUpload. When
that body failed part way through, go-libvirt deadlocked: requestStream
starts its stream sender on two unbuffered channels and, on the error
path, returns without ever reading outErr, so SendStream emits a
StatusError packet and parks on `outErr <-` forever while the main
goroutine parks on `abort <- true` forever. StorageVolUpload never
returned. The 20-minute transfer budget rescued the caller only, and the
socket kill did nothing, because both ends are blocked on channel sends
rather than on I/O -- which is what the comment at backend.go:152 got
wrong. Each failed upload leaked kvm2's call goroutine, go-libvirt's
sender goroutine and a 4 MiB buffer, permanently, against a 128Mi pod
limit and a reconciler that retries on backoff.

The defect is upstream and stays there: no fork, no replace. Instead
eofReader, at the go-libvirt seam so it covers the seed and marker
uploads too, converts any source error to io.EOF -- the one outcome that
ends a stream the normal way -- and keeps the real error for the caller.
countingReader sits underneath untouched, so the existing length and
digest checks report exactly what they did before.

The download also gets its own deadline a minute inside the transfer
budget. fetchImage already bounded the whole fetch at 20 minutes, so the
body's death and the budget's socket kill were racing and the socket
usually won; with the body a minute ahead, a stalled mirror ends through
its reader and unwinds cleanly instead of leaking.

discardVolume moves from uploadImage into fetchImage's upload-error
branch, so the dedicated connection is closed and libvirtd has let go of
the stream's fd before the file is unlinked. Moving it rather than adding
a second Close keeps image_test's closeCount() == 1 true. That discard is
still unfenced against a second provider entry sharing the volume name;
H4 closes that by making the name per-entry.

What remains: a failure originating in libvirtd mid-upload still leaks,
since SendStream has already returned by then. Confirmed unfixable from
here. Known gaps quotes the two-character upstream fix
(make(chan bool, 1) / make(chan error, 1)) and the replace escape hatch.

Unverified at ~85%: that libvirtd answers a short-but-clean stream finish
with OK rather than an error. virFDStreamWrite enforces length only on
writes past it and nothing compares offset to length on the close path,
which is also why virsh vol-upload of a small file into a large volume
works. If it errors we are back to a deadlock by a different door, which
is exactly today's behaviour, so this cannot be worse. The execution file
carries a probe recipe to settle it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

internal/provider/kvm2/image.go

@@ -214,7 +214,12 @@ func (p *Provider) fetchImage(ctx context.Context, host provider.KVMHost, pool l
 	log := p.logger(ctx).WithValues("host", host.Name, "volume", name)
 	start := time.Now()
 
-	resp, err := p.do(ctx, http.MethodGet, src.URL)
+	// The body runs out of time before the surrounding budget does, so a
+	// mirror that stalls mid-image ends the upload through its reader
+	// rather than through the killed socket the budget would leave.
+	httpCtx, cancelHTTP := context.WithTimeout(ctx, defaultBudgets.transfer-transferGrace)
+	defer cancelHTTP()
+	resp, err := p.do(httpCtx, http.MethodGet, src.URL)
 	if err == nil {
 		err = checkResponse(src.URL, resp)
 	}
@@ -227,8 +232,11 @@ func (p *Provider) fetchImage(ctx context.Context, host provider.KVMHost, pool l
 	span.SetAttributes(attribute.Int64("kvm2.bytes", size))
 	log.V(1).Info("fetching base image into host pool", "url", src.URL, "bytes", size)
 
-	vol, digest, err := p.uploadImage(ctx, host, pool, be, src, resp.Body, size)
+	vol, digest, err := p.uploadImage(ctx, host, pool, src, resp.Body, size)
 	if err != nil {
+		// uploadImage has returned, so its dedicated connection is closed
+		// and libvirtd has let go of the stream before the file goes.
+		p.discardVolume(ctx, log, be, pool, name)
 		span.SetStatus(codes.Error, err.Error())
 		return libvirt.StorageVol{}, err
 	}
@@ -249,10 +257,10 @@ func (p *Provider) fetchImage(ctx context.Context, host provider.KVMHost, pool l
 
 // uploadImage creates the base volume and streams body into it over a
 // dedicated connection with a running sha256, then checks length and
-// digest. On any failure the volume is discarded and the error says why:
-// a body that ended early is Transient, a digest that differs from the
-// configured one is Permanent.
-func (p *Provider) uploadImage(ctx context.Context, host provider.KVMHost, pool libvirt.StoragePool, be backend, src imageSource, body io.Reader, size int64) (libvirt.StorageVol, string, error) {
+// digest. The error says why: a body that ended early is Transient, a
+// digest that differs from the configured one is Permanent. Discarding
+// the volume is the caller's, once this connection is closed.
+func (p *Provider) uploadImage(ctx context.Context, host provider.KVMHost, pool libvirt.StoragePool, src imageSource, body io.Reader, size int64) (libvirt.StorageVol, string, error) {
 	name := src.volumeName()
 	xmlDoc, err := buildVolumeXML(volumeSpec{Name: name, CapacityBytes: size, Format: src.Format})
 	if err != nil {
@@ -289,7 +297,6 @@ func (p *Provider) uploadImage(ctx context.Context, host provider.KVMHost, pool
 		err = permanentf("image %s: sha256 %s does not match the configured %s", src.URL, digest, strings.ToLower(src.SHA256))
 	}
 	if err != nil {
-		p.discardVolume(ctx, p.logger(ctx).WithValues("host", host.Name, "volume", name), be, pool, name)
 		return libvirt.StorageVol{}, "", err
 	}
 	return vol, digest, nil