Live proof: supplied ROOTFS staging on remote-libvirt (#1433)

Follow-up to #1433 (merged via PR #1515).

## Why
#1433 shipped the code path that stages an agent-supplied qcow2 as a remote-libvirt System's `base_image_volume` (via `base_image_source: LocalComponentRef`, `upload_qcow2_volume`, per-System `kdive--base.qcow2`, qcow2-magic format gate, and fault/teardown reclaim). It is covered by unit + integration tests that mock the libvirt connection/stream at the boundary, and full `just ci` is green.

Its acceptance criteria state it "cannot be declared done until a live proof exists," gated on the remote `live_vm` tier (#1424, merged). That live proof was **not runnable in the implementation environment** — a remote-libvirt proof needs a *second* remote-libvirt host, and the dev host runs local KVM directly with no remote target. Consistent with the sibling remote-parity campaign (#1428–1435), the code merged and the live proof is tracked here.

## Scope
On a real remote-libvirt host pair (remote `live_vm` tier), prove end-to-end:

- A supplied qcow2 (source kind `local`) is staged onto the remote pool via `upload_qcow2_volume` and becomes the System's `base_image_volume`; the System provisions and the overlay backs onto it.
- A partially-uploaded volume is cleaned up on an injected fault (stream/finish failure) — no orphan volume left on the pool.
- Reclaim on failed provision and on teardown removes the per-System `kdive--base.qcow2`.
- An operator-staged `base_image_volume` System (no `base_image_source`) still provisions unchanged (AC5).
- A non-qcow2 supplied file is rejected at the staging format gate before any volume is created.

## References
- Issue: #1433
- PR: #1515
- ADR: `docs/adr/0440-remote-libvirt-supplied-rootfs-staging.md`
- Remote live_vm tier: #1424

Read ADR docs/adr/0440-remote-libvirt-supplied-rootfs-staging.md, then review the implementation and tests from #1433/#1515 and the remote live_vm tier in #1424. Run the proof on a real remote-libvirt host pair, covering staging, fault cleanup, reclaim, operator-staged volumes, and non-qcow2 rejection; done means all listed scenarios pass with no orphan volumes.

Written by the indexing model from the issue text.