Move subsystem state/locks off Daemon into owning types

Daemon no longer owns a coarse mu shared across unrelated concerns.
Each subsystem now carries its own state and lock:

- tapPool: entries, next, and mu move onto a new tapPool struct.
- sessionRegistry: sessionControllers + its mutex move off Daemon.
- opRegistry[T asyncOp]: generic registry collapses the two ad-hoc
  vm-create and image-build operation maps (and their mutexes) into one
  shared type; the Begin/Status/Cancel/Prune methods simplify.
- vmLockSet: the sync.Map of per-VM mutexes moves into its own type;
  lockVMID forwards.
- Daemon.mu splits into imageOpsMu (image-registry mutations) and
  createVMMu (CreateVM serialisation) so image ops and VM creates no
  longer block each other.

Lock ordering collapses to vmLocks[id] -> {createVMMu, imageOpsMu} ->
subsystem-local leaves. doc.go and ARCHITECTURE.md updated.

No behavior change; tests green.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/daemon/session_controller.go

@@ -106,47 +106,87 @@ type guestSessionStateSnapshot struct {
 	LastError string
 }
 
-func (d *Daemon) setGuestSessionController(id string, controller *guestSessionController) {
-	d.mu.Lock()
-	defer d.mu.Unlock()
-	d.sessionControllers[id] = controller
+// sessionRegistry owns the live guest-session controller map. Its lock is
+// independent of Daemon.mu so guest-session lookups do not contend with
+// unrelated daemon state.
+type sessionRegistry struct {
+	mu     sync.Mutex
+	byID   map[string]*guestSessionController
+	closed bool
 }
 
-func (d *Daemon) claimGuestSessionController(id string, controller *guestSessionController) bool {
-	d.mu.Lock()
-	defer d.mu.Unlock()
-	if d.sessionControllers[id] != nil {
+func newSessionRegistry() sessionRegistry {
+	return sessionRegistry{byID: make(map[string]*guestSessionController)}
+}
+
+func (r *sessionRegistry) set(id string, controller *guestSessionController) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if r.closed {
+		return
+	}
+	r.byID[id] = controller
+}
+
+func (r *sessionRegistry) claim(id string, controller *guestSessionController) bool {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if r.closed {
 		return false
 	}
-	d.sessionControllers[id] = controller
+	if r.byID[id] != nil {
+		return false
+	}
+	r.byID[id] = controller
 	return true
 }
 
-func (d *Daemon) getGuestSessionController(id string) *guestSessionController {
-	d.mu.Lock()
-	defer d.mu.Unlock()
-	return d.sessionControllers[id]
+func (r *sessionRegistry) get(id string) *guestSessionController {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return r.byID[id]
 }
 
-func (d *Daemon) clearGuestSessionController(id string) *guestSessionController {
-	d.mu.Lock()
-	defer d.mu.Unlock()
-	controller := d.sessionControllers[id]
-	delete(d.sessionControllers, id)
+func (r *sessionRegistry) clear(id string) *guestSessionController {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	controller := r.byID[id]
+	delete(r.byID, id)
 	return controller
 }
 
-func (d *Daemon) closeGuestSessionControllers() error {
-	d.mu.Lock()
-	controllers := make([]*guestSessionController, 0, len(d.sessionControllers))
-	for _, controller := range d.sessionControllers {
+func (r *sessionRegistry) closeAll() error {
+	r.mu.Lock()
+	controllers := make([]*guestSessionController, 0, len(r.byID))
+	for _, controller := range r.byID {
 		controllers = append(controllers, controller)
 	}
-	d.sessionControllers = nil
-	d.mu.Unlock()
+	r.byID = nil
+	r.closed = true
+	r.mu.Unlock()
 	var err error
 	for _, controller := range controllers {
 		err = errors.Join(err, controller.close())
 	}
 	return err
 }
+
+func (d *Daemon) setGuestSessionController(id string, controller *guestSessionController) {
+	d.sessions.set(id, controller)
+}
+
+func (d *Daemon) claimGuestSessionController(id string, controller *guestSessionController) bool {
+	return d.sessions.claim(id, controller)
+}
+
+func (d *Daemon) getGuestSessionController(id string) *guestSessionController {
+	return d.sessions.get(id)
+}
+
+func (d *Daemon) clearGuestSessionController(id string) *guestSessionController {
+	return d.sessions.clear(id)
+}
+
+func (d *Daemon) closeGuestSessionControllers() error {
+	return d.sessions.closeAll()
+}