kvm2: SSH transport, ctx-first libvirt seam, host table and span decorator

Every go-libvirt call runs under its own budget and a cancelled or overlong
call kills the connection; credentials are read on every dial; one span and
one log line per RPC come from a decorator applied where connections are
made.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/plans-executions/2026-09-16-1333-kvm2-provider.md

@@ -6,7 +6,7 @@ Plan: [docs/plans/2026-09-16-1333-kvm2-provider.md](../plans/2026-09-16-1333-kvm
 - [x] Step 1 — The spec, `docs/kvm2-provider-spec.md`
 - [x] Step 2 — Config wiring, IDs, state mapping, classify
 - [x] Step 3 — Pure builders: domain and volume XML, metadata, seed
-- [ ] Step 4 — Transport, seam, decorator, fakes
+- [x] Step 4 — Transport, seam, decorator, fakes
 - [ ] Step 5 — Image cache and pool-space precheck
 - [ ] Step 6 — The four contract methods
 - [ ] Step 7 — Checker and the CRD comment
@@ -125,3 +125,49 @@ go build ./... && go test -short ./...
 All `ok`. Review greps for a v1 import or v1 identifiers are empty; the only
 `type="volume"` in the package is the comment explaining why it is not used.
 The agent reported "files read outside the allowed set: none".
+
+## Step 4 — Transport, seam, decorator, fakes
+
+2026-09-16 17:42. Third subagent step, the largest: `backend.go` (the
+ctx-first seam `backend`, the production adapter `libvirtBackend`, a
+generic `call[T]` helper with per-call budgets and the abandon policy),
+`ssh.go` (credentials read on every dial, stage-tagged `dialError`, the
+forwarded socket, keepalive), `hosts.go` (`hostTable` with a per-host
+channel semaphore so waiting for a dial ends with the caller's ctx,
+`dialFresh` for dedicated connections, the production `libvirtDialer`
+starting the `kvm2.dial` span and applying the decorator once),
+`observe.go` (one span `kvm2.<Method>` and one `libvirt call` line per
+RPC), plus an in-memory `fakeBackend`, an in-process SSH server and 41
+tests. The agent also drove the real adapter over go-libvirt's own
+`libvirttest` mock through a `net.Pipe`, which the brief did not ask for.
+
+Abandon policy as built: a call that outlives its ctx or budget kills the
+link (closes the socket and the SSH client), returns Transient wrapping the
+ctx or deadline error, and other in-flight calls on that connection fail once
+with go-libvirt's `ErrInterrupted`; the next `get` redials. Results travel
+through a channel so a late-finishing abandoned call never writes into its
+caller's frame; the agent reported that the first `-race` run caught exactly
+that bug in an earlier version.
+
+Decisions the agent made, accepted: liveness is a separate unexported
+interface so the reflection test over `backend` stays at the 20 RPCs plus
+`Close`; `Close` sends a bounded `ConnectClose` before killing the link;
+`observe` and the dialer take `...tracing.Option` so tests can inject a
+recording tracer provider, as `provider.WithTracing` does.
+
+Clean-room note: three type names coincide with names v1 uses
+(`dialError`, `dialStage`, `hostEntry`). The brief described each concept
+("an error type that records which stage failed", "a per-host entry") so the
+names follow from the description; the greps for a v1 import and for the
+listed v1 identifiers are empty and the agent attested to reading nothing
+under `internal/provider/kvm/`.
+
+Commands (agent and orchestrator):
+
+```sh
+gofmt -l ./internal/provider/kvm2 ; go vet ./internal/provider/kvm2/ && go test -race -count=2 ./internal/provider/kvm2/
+go build ./... && go test -short ./...
+grep -n 'context.Background()' internal/provider/kvm2/*.go | grep -v _test.go   # empty
+```
+
+All `ok`; the agent also ran the timing-sensitive tests at `-count=8`.