Hygiene round: context discipline on cleanup paths, comment budget, wg.Go

[CMGS]

Adjudicated hygiene findings from the cocoon-macos style walkthrough. No new mechanisms, no restructuring beyond the three rows.

Commits

review: drop call-site comments duplicated from the callee godoc — cmd/vm/lifecycle.go +2 −2, comments 13 → 11.
ensureNetnsLoopback and launchCmd already document the netns loopback and the ip netns exec wrapping on their own godoc. The launch call site repeated both facts.

fix: thread the caller context through cleanup paths — 5 files, +51 −29, comments unchanged (one reworded in qemu/inject.go, 9 → 9).
Detached cleanup paths built a fresh root context instead of deriving one from the caller, dropping whatever the caller's context carried and hiding which call sites are deliberately uncancelable. Every one of them now uses context.WithoutCancel(ctx), with the timeout kept where there was one.

• cleanupFailedVM takes the caller ctx; create/run/clone rollback runs on a bounded detached copy.
• nbdConnection.disconnect and cleanupNBDMount gain a ctx parameter; connectFreeNBD's two failure paths derive their cleanup ctx from the caller. A lost qemu-nbd --disconnect leaves a server pinning the OpenCore qcow2 and the next inject finds no free /dev/nbd.
• vm rm reaps stray helpers under the command ctx, matching the sibling branch that already terminates QEMU and tears down networking under it. The 30 s detached window made Ctrl-C ignored on exactly one of the two rm paths.
• withVMLock and withNBDLease release under WithoutCancel(ctx) — not a raw Background, and not the live ctx, which would strand the in-process token once the caller cancels.
• scaffoldVM resolves the command ctx before deriving its reset budget.

TestWithVMLockUnlocksAfterCallerCancel pins the release contract: it deadlocks the second acquire when release honors a cancelled caller ctx (verified by mutation). flock.Unlock ignores its ctx parameter today, so the two lock rows are a contract fix rather than a live failure.

review: use wg.Go for the test goroutine pairs — 2 files, +6 −12, comments unchanged (0 in both).
Go 1.25 wg.Go replaces the hand-rolled Add/Done + go func pairs in the VM lock and NBD lease concurrency tests.

Comment delta

Net −2 lines across the branch; no file's comment count rose.

Gates

All GOWORK=off from the worktree root.

$ make lint
==> golangci-lint GOOS=linux
0 issues.
==> golangci-lint GOOS=darwin
0 issues.

$ make fmt-check      # exit 0, no output

$ asl ./...           # exit 0
$ GOOS=linux asl ./...  # exit 0

$ go test -race -count=1 ./...
ok  	github.com/cocoonstack/cocoon-macos/cmd/image	1.332s
ok  	github.com/cocoonstack/cocoon-macos/cmd/vm	1.856s
ok  	github.com/cocoonstack/cocoon-macos/home	1.567s
ok  	github.com/cocoonstack/cocoon-macos/qemu	2.112s