nixos/activation/bootspec: module-ify

This does the following:

* turns bootspec into a NixOS module
* validates bootspecs with Cue
* exposes internal knobs

nixos/modules/system/activation/top-level.nix

@@ -9,14 +9,6 @@ let
         "${config.system.boot.loader.kernelFile}";
       initrdPath = "${config.system.build.initialRamdisk}/" +
         "${config.system.boot.loader.initrdFile}";
-
-      bootSpec = import ./bootspec.nix {
-        inherit
-          config
-          pkgs
-          lib
-          children;
-      };
     in ''
       mkdir $out
 
@@ -88,7 +80,8 @@ let
       echo -n "${toString config.system.extraDependencies}" > $out/extra-dependencies
 
       ${optionalString (!config.boot.isContainer) ''
-        ${bootSpec.writer}
+        ${config.boot.bootspec.writer}
+        ${config.boot.bootspec.validator} "$out/bootspec/${config.boot.bootspec.filename}"
       ''}
 
       ${config.system.extraSystemBuilderCmds}