feat(checks): vm-status probe + matrix cert dial-by-name

VMs declared monitoring [ping], but many block ICMP and lack a guest agent
(haos), so ping was the wrong probe — a powered-on VM reported "down". Add a
vm-status check: `qm status <pve_id>` on the VM's Proxmox host, which tests
"powered on" without needing the VM's network at all. vm type monitoring is
now [vm-status].

matrix.hubris.network is a public hostname (federation) resolving to
netbird-vps, not served by the lab Caddy — so its cert-expiry check's
dial=caddy IP failed. Drop the dial for matrix; it dials by name (DNS ->
public) like wget already proved works.

seeds/inventory.yaml

@@ -350,7 +350,7 @@ entities:
   - {slug: "cert:media.hubris.network", type: certificate, name: media.hubris.network, attributes: {dial: "192.168.8.175"}}
   - {slug: "cert:cloud.hubris.network", type: certificate, name: cloud.hubris.network, attributes: {dial: "192.168.8.175"}}
   - {slug: "cert:paperless.hubris.network", type: certificate, name: paperless.hubris.network, attributes: {dial: "192.168.8.175"}}
-  - {slug: "cert:matrix.hubris.network", type: certificate, name: matrix.hubris.network, attributes: {dial: "192.168.8.175"}}
+  - {slug: "cert:matrix.hubris.network", type: certificate, name: matrix.hubris.network}
   - {slug: "cert:photos.hubris.network", type: certificate, name: photos.hubris.network, attributes: {dial: "192.168.8.175"}}
   - {slug: "cert:artifacto.hubris.network", type: certificate, name: artifacto.hubris.network, attributes: {dial: "192.168.8.175"}}
   - {slug: "cert:trmnl.hubris.network", type: certificate, name: trmnl.hubris.network, attributes: {dial: "192.168.8.175"}}

seeds/ontology.yaml

@@ -272,7 +272,9 @@ entity_types:
     layer: infrastructure
     lifecycle: infrastructure
     description: Virtual machine.
-    monitoring: [ping]            # no guest agent assumed; reachability only
+    monitoring: [vm-status]       # `qm status` from the host: powered-on liveness
+                                  # that works even when the VM blocks ICMP and has
+                                  # no guest agent (haos). ping is unreliable for VMs.
     attributes:
       type: object
       properties: