feat(checks): vm-status probe + matrix cert dial-by-name

VMs declared monitoring [ping], but many block ICMP and lack a guest agent
(haos), so ping was the wrong probe — a powered-on VM reported "down". Add a
vm-status check: `qm status <pve_id>` on the VM's Proxmox host, which tests
"powered on" without needing the VM's network at all. vm type monitoring is
now [vm-status].

matrix.hubris.network is a public hostname (federation) resolving to
netbird-vps, not served by the lab Caddy — so its cert-expiry check's
dial=caddy IP failed. Drop the dial for matrix; it dials by name (DNS ->
public) like wget already proved works.

internal/checkdefaults/defaults.go

@@ -32,6 +32,7 @@ const (
 	KindCapacity   = "capacity"
 	KindBackup     = "backup-freshness"
 	KindCertExpiry = "cert-expiry"
+	KindVMStatus   = "vm-status"
 )
 
 // defaultBackupMaxAge is how long a backup target may go without a new
@@ -295,6 +296,19 @@ func buildKind(kind string, t Target, attrs map[string]any, host, user string, p
 			config:   config,
 			interval: 3600,
 		}}, ""
+
+	case KindVMStatus:
+		// "Is the VM powered on" via `qm status` on its Proxmox host — the
+		// right reachability probe for a VM, since many block ICMP and lack a
+		// guest agent. checkVMStatus re-reads pve_id + host at runtime.
+		if _, ok := attrs["pve_id"]; !ok {
+			return nil, "no pve_id to run qm status"
+		}
+		return []checkDef{{
+			kind:     "vm-status",
+			config:   map[string]any{},
+			interval: 60,
+		}}, ""
 	}
 
 	return nil, "no builder for this kind yet"