support dual launch templates: spot for normal builds, on-demand for nested virtualization

AWS does not allow cpu_options.nested_virtualization with spot instances. Add a second
launch template (on-demand, cpu_options enabled) alongside the existing spot template.
The autoscaler selects the template per-system based on nested_virtualization config.

- RuntimeAdapter.launch_spot -> launch_instance(nested_virtualization=False)
- EC2Runtime: selects spot or on-demand LT; raises misconfiguration error if
  on_demand_launch_template_id is empty when nested_virtualization=True
- AwsConfig: add on_demand_launch_template_id field
- SystemConfig: add nested_virtualization field
- Scheduler: looks up system config to pass nested_virtualization flag
- NixOS module: new aws.onDemandLaunchTemplateIdFile + capacity.nestedVirtualization
  options; assertion prevents enabling nestedVirtualization without the LT ID file

agent/nix_builder_autoscaler/runtime/fake.py

@@ -38,8 +38,10 @@ class FakeRuntime(RuntimeAdapter):
         self._tick_count: int = 0
         self._next_ip_counter: int = 1
 
-    def launch_spot(self, slot_id: str, user_data: str) -> str:
-        """Launch a fake spot instance."""
+    def launch_instance(
+        self, slot_id: str, user_data: str, *, nested_virtualization: bool = False
+    ) -> str:
+        """Launch a fake instance (nested_virtualization is accepted but ignored)."""
         if slot_id in self._launch_failures:
             self._launch_failures.discard(slot_id)
             raise RuntimeAdapterError(