Add KVM provider image cache: fetch base images into host pools on first use

resolveImage maps placement.image to a configured key or URL; imageCache
streams the download through StorageVolUpload with a sha256 tee, writes
a marker volume when the upload is verified, and re-fetches when the
marker is missing or the configured checksum changed. Errors carry
taxonomy sentinels that classify now honours. Adds the in-memory fake
libvirt API used from here on.

Step 3b of docs/plans/2026-09-04-1404-kvm-provider.md.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/provider/kvm/errors_test.go

@@ -38,6 +38,8 @@ func TestClassify(t *testing.T) {
 		{"internal error", lvErr(libvirt.ErrInternalError), provider.ErrTransient},
 		{"storage vol exists", lvErr(libvirt.ErrStorageVolExist), provider.ErrTransient},
 		{"wrapped libvirt error", fmt.Errorf("defining: %w", lvErr(libvirt.ErrNoDomain)), provider.ErrNotFound},
+		{"pre-tagged permanent", fmt.Errorf("%w: image returned HTTP 404", provider.ErrPermanent), provider.ErrPermanent},
+		{"pre-tagged transient wrapping libvirt not-found", fmt.Errorf("%w: %w", provider.ErrTransient, lvErr(libvirt.ErrNoDomain)), provider.ErrTransient},
 		{"transport eof", io.EOF, provider.ErrTransient},
 		{"context cancelled", context.Canceled, provider.ErrTransient},
 		{"plain error", errors.New("ssh: handshake failed"), provider.ErrTransient},