A sweep of the whole console: status codes, a data race, atomic writes, dead code

From the race detector, staticcheck, a garbage-in battery over every safe route and a
headless pass through every tab on two machines. Fixed:
- docker inspect/health of a container that isn't there answered 500; now 404, and a
  daemon that is down 503 (dockerErr, with a test).
- /api/virt/instances/{name} on a machine without Incus answered 502 "incus not found";
  it now says Incus isn't ready, like its siblings.
- Deleting a ZFS snapshot with a bad name answered 500; a bad name is 400, a snapshot
  that doesn't exist 404.
- The task list read a task's Running flag without the task's lock while the waiter
  goroutine cleared it: a data race, now read under the lock.
- The Virtualization export config and run record were written in place; a crash
  mid-write would have left a half file. Atomic now, like the config and state files.
- An unused function in kvm.go, one in incus/subnet.go, an unused field in files/move.go
  and a capitalised error string, from staticcheck.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/api/docker.go

@@ -343,6 +343,21 @@ func (s *Server) dockerLogs(w http.ResponseWriter, r *http.Request) {
 }
 
 // dockerInspect is the parts of `docker inspect` worth reading on a phone.
+// dockerErr answers for a docker command that failed: a thing that isn't there is a 404,
+// the daemon being away a 503, anything else a 500.
+func dockerErr(w http.ResponseWriter, err error) {
+	msg := strings.TrimSpace(strings.TrimPrefix(strings.TrimSpace(err.Error()), "error: "))
+	low := strings.ToLower(msg)
+	switch {
+	case strings.Contains(low, "no such object") || strings.Contains(low, "no such container") || strings.Contains(low, "not found"):
+		jsonErr(w, 404, msg)
+	case strings.Contains(low, "cannot connect to the docker daemon") || strings.Contains(low, "is the docker daemon running"):
+		jsonErr(w, 503, msg)
+	default:
+		jsonErr(w, 500, msg)
+	}
+}
+
 func (s *Server) dockerInspect(w http.ResponseWriter, r *http.Request) {
 	id := r.PathValue("id")
 	if !dockerRef.MatchString(id) {
@@ -352,9 +367,13 @@ func (s *Server) dockerInspect(w http.ResponseWriter, r *http.Request) {
 	ctx, cancel := context.WithTimeout(r.Context(), 15*time.Second)
 	defer cancel()
 	out, err := dockerRun(ctx, "inspect", id)
+	if err != nil {
+		dockerErr(w, err)
+		return
+	}
 	var all []map[string]any
-	if err != nil || json.Unmarshal(out, &all) != nil || len(all) == 0 {
-		jsonErr(w, 500, fmt.Sprint("inspect failed: ", err))
+	if json.Unmarshal(out, &all) != nil || len(all) == 0 {
+		jsonErr(w, 500, "inspect: unreadable answer")
 		return
 	}
 	c := all[0]
@@ -486,7 +505,7 @@ func (s *Server) dockerHealth(w http.ResponseWriter, r *http.Request) {
 	defer cancel()
 	out, err := dockerRun(ctx, "inspect", "--format", "{{json .State}}", id)
 	if err != nil {
-		jsonErr(w, 500, err.Error())
+		dockerErr(w, err)
 		return
 	}
 	var st struct {