feat(bpmct/templates): add incus-vm and incus-nixos templates

[bpmct]

Description

Adds two new templates under registry/bpmct for running workspaces on Incus (the open-source LXD fork).

incus-vm

Provisions a full KVM virtual machine on a remote Incus host using cloud-init. This is a VM variant of the existing coder/incus system container template.

Key differences from coder/incus:

• Launches a virtual machine (type = "virtual-machine") rather than a system container
• Supports remote Incus hosts via incus remote add — the Coder provisioner does not need to be co-located with the Incus host
• arch parameter (amd64 / arm64) threads through the agent, image fetch, and Incus architecture hint — so the same template works on both x86-64 and aarch64 hosts
• Token rotation handled on every workspace start via a null_resource provisioner (necessary since cloud-init only runs once on first boot)

incus-nixos

Provisions a NixOS virtual machine on a remote Incus host. NixOS requires a different provisioning approach from the cloud-init-based incus-vm template.

Key design points:

• Uses Incus's official NixOS images (nixos/<channel>)
• Provisions entirely via nixos-rebuild switch — no cloud-init
• Writes /etc/nixos/coder.nix and /etc/nixos/configuration.nix via incus exec on first boot
• Idempotent: subsequent starts skip the rebuild and just refresh the agent token
• nixos_channel is a Terraform variable (admin sets at push time); no user-facing image picker since the whole point of the template is NixOS

Type of Change

• New module
• New template
• Bug fix
• Feature/enhancement
• Documentation
• Other

Template Information

Paths:

• registry/bpmct/templates/incus-vm
• registry/bpmct/templates/incus-nixos

Testing & Validation

• Tests pass (bun test)
• Code formatted (bun fmt)
• Changes tested locally (both templates deployed and workspaces verified healthy on aarch64 Raspberry Pi provisioners)

Related Issues

None

Video

https://www.loom.com/share/f009972a51af452dbbe9eda9f9760d3e