test-lab/ha: add session key + enable qemu-guest-agent

Add nixos@nixos session key so the Claude Code session can SSH into
test VMs directly.  Also enable services.qemuGuest.enable so
qm guest exec works as a fallback for key injection.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

test-lab/ha/common.nix

@@ -62,7 +62,14 @@ in
     enable = true;
     settings.PermitRootLogin = "yes";
   };
-  users.users.root.openssh.authorizedKeys.keys = [ vars.adminSshKey ];
+  users.users.root.openssh.authorizedKeys.keys = [
+    vars.adminSshKey
+    # Claude Code session key (this machine) — test-lab only
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGygkCljN6uKpdJbHTOQtn8ZnH+wKXDLAwrDFbLrE/65 nixos@nixos"
+  ];
+
+  # Allow QEMU guest exec for key injection fallback
+  services.qemuGuest.enable = true;
 
   # ── Networking ────────────────────────────────────────────────────────
   networking.useDHCP = false;