Add KVM provider methods: Create/Get/Delete/ListByTag over the libvirt seam

Create looks the domain up first and only starts it when it exists;
otherwise it caches the image, reuses or creates the overlay, rebuilds
the seed ISO unconditionally (a cancelled upload can leave a truncated
seed that no later attempt would repair), defines and starts the domain.
Get maps libvirt state plus the first routable IPv4 from ARP or the
guest agent onto the provider states. Delete destroys, undefines and
removes the per-VM volumes by name, tolerating every already-gone case.
ListByTag keeps managed domains across all hosts, skipping domains it
cannot read and failing the sweep only for an unreachable host.

Also corrects the Step 2 seed determinism test: the iso9660 writer
stamps the build time into the volume descriptor, so builds differ by a
few bytes; the test now compares label, files and size.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/provider/kvm/seed_test.go

@@ -3,6 +3,7 @@ package kvm
 import (
 	"bytes"
 	"io"
+	"maps"
 	"strings"
 	"testing"
 
@@ -63,7 +64,10 @@ func TestBuildSeedISO_contents(t *testing.T) {
 	}
 }
 
-func TestBuildSeedISO_deterministic(t *testing.T) {
+// The writer stamps the build time into the volume descriptor, so two
+// builds are not byte-identical; what must not change between them is
+// what cloud-init reads: the label and the three files.
+func TestBuildSeedISO_deterministicContent(t *testing.T) {
 	t.Parallel()
 	a, err := buildSeedISO("proxy-x", "#cloud-config\n", "")
 	if err != nil {
@@ -73,8 +77,13 @@ func TestBuildSeedISO_deterministic(t *testing.T) {
 	if err != nil {
 		t.Fatalf("second buildSeedISO() error = %v", err)
 	}
-	if !bytes.Equal(a, b) {
-		t.Error("two builds for the same inputs differ; a re-created seed must be byte-identical")
+	labelA, filesA := readSeed(t, a)
+	labelB, filesB := readSeed(t, b)
+	if labelA != labelB || !maps.Equal(filesA, filesB) {
+		t.Errorf("two builds for the same inputs differ: %q %v vs %q %v", labelA, filesA, labelB, filesB)
+	}
+	if len(a) != len(b) {
+		t.Errorf("sizes differ: %d vs %d; the seed volume is created with the ISO's exact size", len(a), len(b))
 	}
 }