support dual launch templates: spot for normal builds, on-demand for nested virtualization

AWS does not allow cpu_options.nested_virtualization with spot instances. Add a second
launch template (on-demand, cpu_options enabled) alongside the existing spot template.
The autoscaler selects the template per-system based on nested_virtualization config.

- RuntimeAdapter.launch_spot -> launch_instance(nested_virtualization=False)
- EC2Runtime: selects spot or on-demand LT; raises misconfiguration error if
  on_demand_launch_template_id is empty when nested_virtualization=True
- AwsConfig: add on_demand_launch_template_id field
- SystemConfig: add nested_virtualization field
- Scheduler: looks up system config to pass nested_virtualization flag
- NixOS module: new aws.onDemandLaunchTemplateIdFile + capacity.nestedVirtualization
  options; assertion prevents enabling nestedVirtualization without the LT ID file

agent/nix_builder_autoscaler/tests/test_runtime_ec2.py

@@ -73,7 +73,7 @@ class TestLaunchSpot:
         stubber.add_response("run_instances", response, expected_params)
         runtime = _make_runtime(stubber, ec2_client, config=config)
 
-        iid = runtime.launch_spot("slot001", "#!/bin/bash\necho hello")
+        iid = runtime.launch_instance("slot001", "#!/bin/bash\necho hello")
         assert iid == "i-12345678"
         stubber.assert_no_pending_responses()
 
@@ -90,8 +90,8 @@ class TestLaunchSpot:
             )
 
         runtime = _make_runtime(stubber, ec2_client, config=config)
-        runtime.launch_spot("slot001", "")
-        runtime.launch_spot("slot002", "")
+        runtime.launch_instance("slot001", "")
+        runtime.launch_instance("slot002", "")
         stubber.assert_no_pending_responses()
 
 
@@ -418,7 +418,7 @@ class TestErrorClassification:
         runtime = _make_runtime(stubber, ec2_client)
 
         with pytest.raises(RuntimeAdapterError) as exc_info:
-            runtime.launch_spot("slot001", "#!/bin/bash")
+            runtime.launch_instance("slot001", "#!/bin/bash")
         assert exc_info.value.category == "capacity_unavailable"
 
     @patch("nix_builder_autoscaler.runtime.ec2.time.sleep")
@@ -439,7 +439,7 @@ class TestErrorClassification:
         )
         runtime = _make_runtime(stubber, ec2_client)
 
-        iid = runtime.launch_spot("slot001", "#!/bin/bash")
+        iid = runtime.launch_instance("slot001", "#!/bin/bash")
         assert iid == "i-retry123"
         assert mock_sleep.called
         stubber.assert_no_pending_responses()
@@ -460,5 +460,5 @@ class TestErrorClassification:
         runtime = _make_runtime(stubber, ec2_client)
 
         with pytest.raises(RuntimeAdapterError) as exc_info:
-            runtime.launch_spot("slot001", "#!/bin/bash")
+            runtime.launch_instance("slot001", "#!/bin/bash")
         assert exc_info.value.category == "throttled"