feat: test VM build/run script with SSH diagnostics

- nixos/vm.nix: enable PasswordAuthentication for kiosk user (SSH test access)
- scripts/test-vm.sh: one-command build → start → diagnose workflow
  - macOS: builds and runs on remote Linux server, SSH through server
  - Linux: builds and runs locally
  - Commands: --build, --start, --stop, --diagnose, --shell
  - Diagnostics: NetworkManager, PipeWire, wpctl, ALSA, pactl, processes, logs
- AGENTS.md: compact agent guide for the repo

nixos/vm.nix

@@ -62,14 +62,20 @@ in
   systemd.network.wait-online.enable = false;
 
   # ── SSH ───────────────────────────────────────────────────────────────────
-  services.openssh.enable = true;
-  services.openssh.settings.PermitRootLogin = "prohibit-password";
+  services.openssh = {
+    enable = true;
+    settings = {
+      PermitRootLogin = "prohibit-password";
+      PasswordAuthentication = true;
+    };
+  };
 
   # ── User (matches production) ─────────────────────────────────────────────
   users.users.kiosk = {
     isNormalUser = true;
     uid = 1000;
     extraGroups = [ "audio" "video" "input" "networkmanager" "wheel" ];
+    password = "kiosk";
   };
   services.getty.autologinUser = "kiosk";