ci: peel the microVM boot suite into its own peer job (RIG-2697)

[rigel-mintaka]

This PR is part of a stack containing 4 PRs:

1. main
2. "ci: peel the microVM boot suite into its own peer job (RIG-2697)" (this PR)
3. ci: peel the forge live-contract oracle into its own peer job (RIG-2698 T3) #610
4. ci: peel the gtk3 multi-window e2e gate into its own job #611
5. ci: moon concern matrix; dissolve gates; gate every leg (RIG-2700 T5) #621

Move the KVM microVM boot suite out of the monolithic gates job into a
dedicated microvm peer job behind the single CI rollup, so the slow
guest-boot leg (a guest-image realize plus a -race suite under a real VM)
runs in parallel with the moon battery and the other peer jobs, and a
KVM-availability flake reds only microvm rather than the whole gate.

The three microVM steps move verbatim: the ephemeral-runner KVM + userns
relaxations, the boot suite itself (COMPASS_REQUIRE_MICROVM=1, the
out-of-band guest-image and VMM-env nix realizes), and the assert-ran
guard. The job gets a checkout + install-nix + phase-one toolchain
bootstrap (go on PATH is all it needs beyond its in-step realizes); it runs
rootless on a bare runner, no privileged container. gates loses those
three steps and nothing else. The CI rollup gains microvm in needs
and a fourth result assertion, so the single required check is unchanged.

Also close a closure-honesty gap the peel exposes: the microVM leg realizes
tools/toolchain/microvm-vmm-env.nix, which no moon project tracked as an
input. Add it to compass-guest-image's inputs so the moon graph — not a
hand-kept path list — carries the leg's true build closure; a VMM-env-only
change now marks the project affected once a later task gates the leg on
the affected closure.

microvm runs unconditionally on every gate event at this task; a later task
gates it on the microVM affected-closure so an unaffected PR pays zero.

Second task (T2) of the CI job-decomposition plan frozen in
docs/designs/infra/ci/compass-ci-job-decomposition/design.md.

Refs RIG-2697
Co-authored-by: Matt Wilkinson matt@rigel.build

[linear-code]

RIG-2697

[github-actions]

Compass engineering docs preview: https://compass-runner-2697-ci-micro.compass-eng-docs.pages.dev

Deployed from compass-runner/2697-ci-microvm-peer-job at 4ded7f5.

The base branch was changed.