test(guests): boot a guest end to end in a VM (task 0010)

Add a NixOS VM integration test to the flake's checks, so nix flake check
boots the network foundation and one guest on a virtual L2 segment and
asserts the three behaviors a VM can honestly reproduce: the guest presents
its own MAC distinct from the host's, gets its own IP on a tagged VLAN
across the segment, and writes to a bind mount owned by the shared storage
group. A tagged router node serving DHCP only on VLAN 10 makes the address
and reverse ping prove 802.1Q tagging end to end, not plain reachability.

Booting a networked guest surfaced a latent defect: the guest's own networkd
default-enables systemd-resolved, which conflicts with the nested-container
default of inheriting the host's resolv.conf, failing the guest toplevel
build. Fix it in the guest networking realization so a networked guest keeps
its own resolver.

flake.nix

@@ -79,9 +79,16 @@
       # Every host under hosts/ is discovered and built.
       nixosConfigurations = my.mkHosts (self + "/hosts");
 
-      # `nix flake check` builds each host's toplevel.
+      # `nix flake check` builds each host's toplevel, and boots one guest
+      # end to end in a VM to exercise its externally observable behavior.
       checks.x86_64-linux = lib.mapAttrs (
         _name: host: host.config.system.build.toplevel
-      ) self.nixosConfigurations;
+      ) self.nixosConfigurations
+      // {
+        guest-integration = import ./tests/guest-integration.nix {
+          inherit inputs self;
+          system = "x86_64-linux";
+        };
+      };
     };
 }