CI should check that SSH works

[atalii]

Ideally:

1. There's a dummy user with no permissions and a keypair.
2. CI checks that we can get in as the dummy user.
3. If we can get in as the dummy user, we conclude that SSH works and the change is okay.

This could be with NixOS tests, but we should be able to do this with a QEMU VM, which would help if we ever need to move off of NixOS.

(This is all my problem; just keeping this issue open for bookkeeping reasons.)