vz: only ignore expected connection-closed errors in Shutdown

Previously Client.Shutdown returned nil for any httpClient.Do error,
masking real failures (e.g. socket unreachable, connection refused)
as successful shutdowns. This could leave orphaned vz-shim processes.

Now only expected connection-closed errors (EOF, ECONNRESET, EPIPE,
net.ErrClosed) are treated as successful shutdown indicators. All
other transport errors are propagated to the caller so higher layers
can detect and react to actual failures.

Author: cursoragent

lib/hypervisor/vz/client.go

@@ -5,10 +5,12 @@ package vz
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net"
 	"net/http"
+	"syscall"
 	"time"
 
 	"github.com/kernel/hypeman/lib/hypervisor"
@@ -116,13 +118,28 @@ func (c *Client) Shutdown(ctx context.Context) error {
 	}
 	resp, err := c.httpClient.Do(req)
 	if err != nil {
-		// Connection reset is expected when shim exits
-		return nil
+		// Connection reset / EOF is expected when the shim exits in
+		// response to the shutdown request. Any other error means the
+		// request may not have reached the shim.
+		if isExpectedShutdownError(err) {
+			return nil
+		}
+		return fmt.Errorf("shutdown shim: %w", err)
 	}
 	defer resp.Body.Close()
 	return nil
 }
 
+// isExpectedShutdownError reports whether err is a connection-closed error
+// that is expected when the vz-shim process exits after handling a shutdown
+// request.
+func isExpectedShutdownError(err error) bool {
+	return errors.Is(err, io.EOF) ||
+		errors.Is(err, syscall.ECONNRESET) ||
+		errors.Is(err, syscall.EPIPE) ||
+		errors.Is(err, net.ErrClosed)
+}
+
 func (c *Client) GetVMInfo(ctx context.Context) (*hypervisor.VMInfo, error) {
 	body, err := c.doGet(ctx, "/api/v1/vm.info")
 	if err != nil {