kvm2: integration test, sample Proxy, providers-config entries and Makefile target

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/plans-executions/2026-09-16-1333-kvm2-provider.md

@@ -10,7 +10,7 @@ Plan: [docs/plans/2026-09-16-1333-kvm2-provider.md](../plans/2026-09-16-1333-kvm
 - [x] Step 5 — Image cache and pool-space precheck
 - [x] Step 6 — The four contract methods
 - [x] Step 7 — Checker and the CRD comment
-- [ ] Step 8 — Deployment files, Makefile, integration test
+- [x] Step 8 — Deployment files, Makefile, integration test
 - [ ] Step 9 — Documentation
 - [ ] Step 10 — Milestone review
 - [ ] Step 11 — Real-host validation, changelog, MR
@@ -281,3 +281,40 @@ so it built its own locked capture; the orchestrator fixed `captureContext`
 with a mutex in this commit and re-ran the package at `-race -count=3`.
 
 Attestation: "files read outside the allowed set: none".
+
+## Step 8 — Deployment files, Makefile, integration test
+
+2026-09-16 19:39. Seventh subagent step. `kvm2_integration_test.go`
+(`//go:build integration`, `KVM2_TEST_*` variables, the eleven ordered
+assertions of spec entry 21 plus `TestKVM2Check_realHost`),
+`config/samples/proxy_kvm2.yaml` (zone `beelink`, so the sample matches the
+shipped config), a commented `kvm2-home` entry in both providers configs
+with the porting note, comment-only edits on the shared `kvm-ssh` mount, the
+`test-integration-kvm2` Makefile target and the kvm2 rows and section in
+`docs/testing.md`. The integration test was not run; that is Step 11 with
+the user's go-ahead.
+
+The agent found that `New` builds the production dialer without tracing
+options, so in production the dialer and decorator use the global tracer
+provider (correct: `cmd/main.go` sets it up), while a test that wants every
+span family in one recorder sets the dialer's option itself. The test does
+so and asserts that `kvm2.DomainDefineXML` and `kvm2.dial` are children of
+`provider.create`.
+
+Decisions the agent made, accepted: the UID is generated from `crypto/rand`
+rather than promoting `google/uuid` to a direct dependency; the sentinel
+check looks for the full cloud-init string because the provider name also
+appears in attributes; `-run TestKVM2` matches both tests, as the kvm
+target's pattern does. Forward links to `docs/kvm2-provider.md` dangle until
+Step 9.
+
+Commands:
+
+```sh
+go vet ./... && go vet -tags=integration ./... && go vet -tags=e2e ./...
+bin/kustomize build config/default > /dev/null && bin/kustomize build config/samples > /dev/null
+make -n test-integration-kvm2
+# go test -race -tags=integration -count=1 -v -timeout 40m -run TestKVM2 ./internal/provider/kvm2/
+```
+
+All clean. Attestation: "files read outside the allowed set: none".