Boot-time reclamation of device-mapper and loop devices orphaned by an unclean shutdown (SIGKILL or :erlang.halt, where the owning GenServers' terminate/2 never ran to tear them down).

Hyper names every dm device it creates with a hyper- prefix (hyper-thinpool, hyper-rw-<vm>, hyper-img-<img>-<n>), so this removes exactly those - never an operator's unrelated dm devices. Removal is leaf-first: a device still open by another (the pool under a thin volume, a snapshot under the next in its chain) refuses until its dependents are gone, so leftovers are retried until a pass removes nothing new. Loop devices backing files under Hyper's data dirs are then detached (the dm devices that held them are gone by that point).

Entirely best-effort: every failure is logged and boot continues. It runs once, before any device-owning GenServer starts, so the freshly-booting node never collides with its own previous instance's leftovers.