feat(chopper): add an echoip microvm guest

[devusb]

Adds a first guest on top of the microvm host support from #118. echoip is trivial enough that it makes plain whether a guest booted and reached the network, which is the point of it.

Everything but the three things that have to be unique comes from common.nix: a static address from below the DHCP pool so Kea has nothing to hand out, the tap interface, and a vsock CID.

Verified on chopper

Deployed with colmena apply test before being split out of the original branch:

• vm-echoip lands in br0 alongside enp6s0 and vnet0, with no host networking changes
• the guest answers on 192.168.20.50 and echoip returns the caller's address
• machinectl list shows it as class vm, service microvm.nix
• microvm -s echoip connects over VSOCK
• tailscale ping from chopper resolves direct at 1ms via 192.168.20.50:41641 rather than falling back to a DERP relay
• ssh host keys and the tailscale node identity survive a restart on the /var/lib volume

Kept as a draft

This is deliberately parked rather than merged. It exists as a worked reference for the shape a guest takes — the intended first real guest is hermes, which will need substantially more memory and vcpu, a nested volume for podman's container storage, and its own credentials.

[devusb]

Heads up from #120 — worth renaming the guest to vm-echoip here for the same reason.

Nodes and Tailscale Services share a MagicDNS namespace, and machine names resolves a collision by appending a suffix that persists "even if the conflicting machine's name is later changed". So a guest named after the thing it runs can permanently become <name>-1 the moment a Service wants that name.

Renaming the attribute to vm-echoip is enough — microvm derives networking.hostName from it, so the unit, state directory, tap and hostname all line up, and it matches the tap-interface convention already in use. Cheap now, sticky later.