[rducom]

spdk-takeover-proof had three defects, met on a node in a rolling upgrade. One of them held that node out of every upgrade until someone stepped in by hand.

• A not-yet read as a verdict. A disk's start or recovery right after ublk_create_target can answer -EAGAIN, because the poll groups set up their buffers on their own threads after the target answered (0058). The return phase took that for a failure. Starts and recoveries now wait up to 10 s while the target answers -EAGAIN.
• A failed phase left disks behind. It stopped only the disks its process served; those it had left to the kernel stayed quiesced, holding the proof's ids. It now takes them back and stops them too, best effort.
• The clean could not clean. It took back a leftover disk over a 64 MiB null bdev, and the recovery refuses a bdev of another size than the disk's (0070). So since 0070, every proof after a failed one failed at clean, saying "another process serves it", which nothing did. It now uses a bdev of the disk's own size, read from /sys/block/ublkb<id>/size, or the proof's lvol size if unreadable.

ublk-functional.sh adds the case: a disk the create phase left to the kernel is taken back and stopped by the next clean.

Not changed: ublk_create_target still answers before its poll groups are ready, and starts and recoveries still answer -EAGAIN until then (0058's contract). Making the target's creation wait would turn the RPC asynchronous across the later ublk patches. The callers that start disks long after the target's creation never meet the window, and the proof now waits for it.

Test: ublk-functional.sh (the proof's phases against this image, then the leftover case). The tool builds with -Wall -Wextra -Werror.