ci: type-check vm test scripts without building the vms

Adds checks.<system>.vm-test-typecheck-<name> for hive-squid, swarm-archive, agent-ephemeral-rootfs, full-setup and wg-hive: ty and ruff F over nixpkgs' test-script prelude, the machine hints from the node names, and the script text. Node configs are never evaluated. vm-test-typecheck-control passes only when ty rejects a known type error.

flake.nix

@@ -232,7 +232,8 @@
 
       # Tests that boot a NixOS VM and need KVM. Not `checks`, so `nix flake
       # check` and the per-PR CI job never build them;
-      # `.forgejo/workflows/vm-nightly.yml` does.
+      # `.forgejo/workflows/vm-nightly.yml` does. Their scripts are type-checked
+      # per PR by `checks.<system>.vm-test-typecheck-*` (nix/vm-test-typecheck.nix).
       vmTests = forAllSystems (
         { pkgs, system, ... }:
         import ./nix/vm-tests.nix {