move vm tests out of checks into a nightly vmTests workflow

flake.nix

@@ -18,6 +18,7 @@
   #   nix/rust.nix      shared crane wiring (cleanSrc, cargoArtifacts)
   #   nix/packages/     every package output
   #   nix/checks.nix    flake checks
+  #   nix/vm-tests.nix  VM tests, the `vmTests` output
   #   nix/devshell.nix  dev shell
   #   nix/treefmt.nix   formatter config
   #   nix/host-modules/, nix/agent-modules/, nix/container-modules/,
@@ -224,6 +225,11 @@
 
       formatter = forAllSystems ({ treefmt-eval, ... }: treefmt-eval.config.build.wrapper);
 
+      # Tests that boot a NixOS VM and need KVM. Not `checks`, so `nix flake
+      # check` and the per-PR CI job never build them;
+      # `.forgejo/workflows/vm-nightly.yml` does.
+      vmTests = forAllSystems ({ pkgs, ... }: import ./nix/vm-tests.nix { inherit pkgs; });
+
       checks = forAllSystems (
         {
           pkgs,