support dual launch templates: spot for normal builds, on-demand for nested virtualization

AWS does not allow cpu_options.nested_virtualization with spot instances. Add a second
launch template (on-demand, cpu_options enabled) alongside the existing spot template.
The autoscaler selects the template per-system based on nested_virtualization config.

- RuntimeAdapter.launch_spot -> launch_instance(nested_virtualization=False)
- EC2Runtime: selects spot or on-demand LT; raises misconfiguration error if
  on_demand_launch_template_id is empty when nested_virtualization=True
- AwsConfig: add on_demand_launch_template_id field
- SystemConfig: add nested_virtualization field
- Scheduler: looks up system config to pass nested_virtualization flag
- NixOS module: new aws.onDemandLaunchTemplateIdFile + capacity.nestedVirtualization
  options; assertion prevents enabling nestedVirtualization without the LT ID file

agent/nix_builder_autoscaler/runtime/base.py

@@ -21,8 +21,14 @@ class RuntimeAdapter(ABC):
     """Interface for compute runtime backends (EC2, fake, etc.)."""
 
     @abstractmethod
-    def launch_spot(self, slot_id: str, user_data: str) -> str:
-        """Launch a spot instance for slot_id. Return instance_id."""
+    def launch_instance(
+        self, slot_id: str, user_data: str, *, nested_virtualization: bool = False
+    ) -> str:
+        """Launch an instance for slot_id. Return instance_id.
+
+        When nested_virtualization is True, an on-demand instance is launched using
+        the on-demand launch template. When False (default), a spot instance is launched.
+        """
 
     @abstractmethod
     def describe_instance(self, instance_id: str) -> dict: