support dual launch templates: spot for normal builds, on-demand for nested virtualization

AWS does not allow cpu_options.nested_virtualization with spot instances. Add a second
launch template (on-demand, cpu_options enabled) alongside the existing spot template.
The autoscaler selects the template per-system based on nested_virtualization config.

- RuntimeAdapter.launch_spot -> launch_instance(nested_virtualization=False)
- EC2Runtime: selects spot or on-demand LT; raises misconfiguration error if
  on_demand_launch_template_id is empty when nested_virtualization=True
- AwsConfig: add on_demand_launch_template_id field
- SystemConfig: add nested_virtualization field
- Scheduler: looks up system config to pass nested_virtualization flag
- NixOS module: new aws.onDemandLaunchTemplateIdFile + capacity.nestedVirtualization
  options; assertion prevents enabling nestedVirtualization without the LT ID file

agent/nix_builder_autoscaler/runtime/ec2.py

@@ -60,6 +60,7 @@ class EC2Runtime(RuntimeAdapter):
     ) -> None:
         self._client: Any = _client or boto3.client("ec2", region_name=config.region)
         self._launch_template_id = config.launch_template_id
+        self._on_demand_launch_template_id = config.on_demand_launch_template_id
         self._subnet_ids = list(config.subnet_ids)
         self._security_group_ids = list(config.security_group_ids)
         self._instance_profile_arn = config.instance_profile_arn
@@ -67,22 +68,32 @@ class EC2Runtime(RuntimeAdapter):
         self._subnet_index = 0
         self._tailscale_socket_path = _tailscale_socket_path
 
-    def launch_spot(self, slot_id: str, user_data: str) -> str:
-        """Launch a spot instance for *slot_id*. Return instance ID."""
+    def launch_instance(
+        self, slot_id: str, user_data: str, *, nested_virtualization: bool = False
+    ) -> str:
+        """Launch an instance for *slot_id*. Return instance ID.
+
+        When nested_virtualization is True, an on-demand instance is launched using the
+        on-demand launch template (cpu_options nested virt enabled, no spot market options).
+        When False (default), a spot instance is launched using the spot launch template.
+        """
+        if nested_virtualization:
+            if not self._on_demand_launch_template_id:
+                raise RuntimeAdapterError(
+                    "nested_virtualization=True but on_demand_launch_template_id is not configured",
+                    category="misconfiguration",
+                )
+            lt_id = self._on_demand_launch_template_id
+        else:
+            lt_id = self._launch_template_id
+
         params: dict[str, Any] = {
             "MinCount": 1,
             "MaxCount": 1,
             "LaunchTemplate": {
-                "LaunchTemplateId": self._launch_template_id,
+                "LaunchTemplateId": lt_id,
                 "Version": "$Latest",
             },
-            "InstanceMarketOptions": {
-                "MarketType": "spot",
-                "SpotOptions": {
-                    "SpotInstanceType": "one-time",
-                    "InstanceInterruptionBehavior": "terminate",
-                },
-            },
             "UserData": user_data,
             "TagSpecifications": [
                 {
@@ -98,6 +109,15 @@ class EC2Runtime(RuntimeAdapter):
             ],
         }
 
+        if not nested_virtualization:
+            params["InstanceMarketOptions"] = {
+                "MarketType": "spot",
+                "SpotOptions": {
+                    "SpotInstanceType": "one-time",
+                    "InstanceInterruptionBehavior": "terminate",
+                },
+            }
+
         if self._subnet_ids:
             subnet = self._subnet_ids[self._subnet_index % len(self._subnet_ids)]
             self._subnet_index += 1