feat(checks): vm-status probe + matrix cert dial-by-name

VMs declared monitoring [ping], but many block ICMP and lack a guest agent
(haos), so ping was the wrong probe — a powered-on VM reported "down". Add a
vm-status check: `qm status <pve_id>` on the VM's Proxmox host, which tests
"powered on" without needing the VM's network at all. vm type monitoring is
now [vm-status].

matrix.hubris.network is a public hostname (federation) resolving to
netbird-vps, not served by the lab Caddy — so its cert-expiry check's
dial=caddy IP failed. Drop the dial for matrix; it dials by name (DNS ->
public) like wget already proved works.

seeds/ontology.yaml

@@ -272,7 +272,9 @@ entity_types:
     layer: infrastructure
     lifecycle: infrastructure
     description: Virtual machine.
-    monitoring: [ping]            # no guest agent assumed; reachability only
+    monitoring: [vm-status]       # `qm status` from the host: powered-on liveness
+                                  # that works even when the VM blocks ICMP and has
+                                  # no guest agent (haos). ping is unreliable for VMs.
     attributes:
       type: object
       properties: