engine: do not force the stop for a missing power report

`sendStop()` swallows `AgentUnavailableException` and `OperationTimedoutException`
and reports success when `force` is true:

    } catch (final AgentUnavailableException | OperationTimedoutException e) {
        if (!force) { return new Pair<>(false, errorMsg); }
    }
    return new Pair<>(true, null);

So a host that is unreachable or too slow to answer counts as a successful
stop, and the caller goes on to release the NICs and IP addresses. A host too
busy to answer is exactly the condition that produces the stale report this
branch is reacting to, so that is the worst case to guess in.

| report              | force | on an unreachable host        |
|---------------------|-------|-------------------------------|
| PowerOff            | true  | unchanged, host said it is down |
| PowerReportMissing  | false | back off, keep the addresses, let a later report decide |

A PowerOff report is the host stating the instance is down. A missing report
only means the host did not list it, which is not the same thing.

Also makes `handlePowerOffReportWithNoPendingJobsOnVM()` protected so this
branch can be tested.

Signed-off-by: Brad House <bhouse@nexthop.ai>

Author: bhouse-nexthop

engine/orchestration/src/main/java/com/cloud/vm/VirtualMachineManagerImpl.java

@@ -5542,7 +5542,7 @@ protected void stopUnmanagedInstanceOnReportingHost(final VMInstanceVO vm) {
                         vm.getInstanceName(), powerHostId, vm.getState()));
     }
 
-    private void handlePowerOffReportWithNoPendingJobsOnVM(final VMInstanceVO vm) {
+    protected void handlePowerOffReportWithNoPendingJobsOnVM(final VMInstanceVO vm) {
         switch (vm.getState()) {
         case Starting:
         case Stopping:
@@ -5570,9 +5570,15 @@ private void handlePowerOffReportWithNoPendingJobsOnVM(final VMInstanceVO vm) {
             // on the host before giving up its resources, otherwise a still-running instance keeps its NICs and IP
             // addresses while the database says they are free and they get handed to another instance.
             if (PowerState.PowerOff.equals(vm.getPowerState()) || PowerState.PowerReportMissing.equals(vm.getPowerState())) {
+                // force is false for a missing report. sendStop() swallows AgentUnavailableException and
+                // OperationTimedoutException and answers success when forced, and a host too busy to answer is
+                // exactly the condition that produced the stale report in the first place. Backing off and letting a
+                // later report decide is better than freeing an address on no evidence. A PowerOff report is the
+                // host stating the instance is down, so that path keeps its previous behaviour.
+                final boolean forceStop = PowerState.PowerOff.equals(vm.getPowerState());
                 final VirtualMachineGuru vmGuru = getVmGuru(vm);
                 final VirtualMachineProfile profile = new VirtualMachineProfileImpl(vm);
-                Pair<Boolean, String> result = sendStop(vmGuru, profile, true, true);
+                Pair<Boolean, String> result = sendStop(vmGuru, profile, forceStop, true);
                 if (!result.first()) {
                     logger.warn("Unable to stop VM {} on its host, not releasing its resources: {}", vm, result.second());
                     return;