The test hardcoded "/nixos.qcow2" but the actual output filename
is derived from image.baseName and image.extension (e.g.
"nixos-image-...-x86_64-linux.qcow2"). Use image.fileName to get
the correct path, matching the pattern in ec2-image.nix.
Also make the IMDS server's token validation conditional: when no
token file exists in the metadata directory, requests are served
without authentication. This supports both EC2 (IMDSv2 with tokens)
and OpenStack (plain GET) metadata fetchers.
micro_httpd returns 501 for PUT requests, so IMDSv2 token acquisition
was never actually tested. Replace it with a minimal Python IMDS server
that handles the full IMDSv2 flow: PUT for token, token validation on
GET requests, and file serving from a metadata directory.
This means the test now validates that:
- The fetcher correctly obtains an IMDSv2 token via PUT
- The token is passed on subsequent metadata GET requests
- Requests without a valid token are rejected (401)
