fix: correctness fixes and verified cleanups from full-codebase audit

[CMGS]

Summary

Bug fixes (user-visible)

• vm console printed wrong endpoints. The VNC line used 590%d (so display 10 rendered as 59010, not 5910) and the disabled defaults produced 590-1 / ssh -p 0. It now derives the VNC endpoint and SSH command from the same vncCol/sshCol helpers vm list uses, printing - when either is disabled.
• vm create/run/clone with an existing --name silently clobbered a live VM. A second call under the same name truncated the running VM's disk overlay and orphaned its qemu. scaffoldVM now refuses when a record already exists (vm "<name>" already exists; rm it first or pick another --name).
• vm rm raced concurrent lifecycle ops. It was the one handler not taking the per-VM flock, so a concurrent start could relaunch qemu between terminate and RemoveAll. rm now runs terminate/teardown/RemoveAll under withVMLock (tolerating a missing dir).
• image pull ignored --force for OCI/ghcr refs. It re-downloaded multi-GiB artifacts already in the store. It now mirrors the URL path's idempotency check and skips the oras download when the ref is present (unless --force).

Hardening

• teardownNet and disconnectNBD now warn on best-effort failures instead of swallowing them, so a leaked TAP/netns or a still-held qcow2 leaves a diagnostic trail.
• setVNCPassword and the InjectConfig forward path take ctx (dial-retry via utils.WaitFor; subprocesses via CommandContext). NBD cleanup deliberately stays on plain exec.Command so it still runs after cancellation.

Refactors (no behavior change)

• isFileHeld uses utils.FindVMMByCmdline (one /proc walk) instead of scanning every process's fd table 10x/s during NBD disconnect.
• --state-dir registered once on the root command (was duplicated per-subtree with drifted help text); qemu.IsQcow2NVRAM is the single source of the NVRAM-format rule (was duplicated across launch args and snapshot selection).
• Extracted scaffoldVM (shared create/clone block); hoisted the OS-independent prepareNet head over the per-OS provisionNet; dropped applyNet's derivable param; utils.EnsureDirs; findFreeNBD/isFileHeld renames; cmp.Or for the net column.

Validation

• gofumpt -l . — clean
• go build ./... and GOOS=linux go build ./... — ok
• GOOS=darwin golangci-lint run ./... and GOOS=linux golangci-lint run ./... — 0 issues each
• go test -race -count=1 ./... — pass
• Smoke-tested against a temp --state-dir: vm console now prints VNC 127.0.0.1:5910 SSH: ssh -p 2222 cocoon@localhost (and -/- when disabled); the duplicate-name guard refuses create --name <existing> and leaves the record dir untouched (no truncated overlay); vm rm prints and exits 0 for a missing name and terminates + removes the dir under the flock for an existing one.

🤖 Generated with Claude Code