vmTools: fix img collision with pkgs.img, add kernelModules arg

Commit 31d1d80b3f ("lib/systems: move kernel configuration out of
the platform structure") changed all-packages.nix from

  vmTools = callPackage ../build-support/vm {
    img = stdenv.hostPlatform.linux-kernel.target;
  };

to

  vmTools = callPackage ../build-support/vm { };

and changed the function default to `img ? kernel.target`. Since
`pkgs.img` exists, `callPackage` now auto-fills the `img` argument
with that attribute and the default is never used.
Anything going through `runInLinuxVM` (make-disk-image,
nixosTests.bootspec.*, etc.) then fails with:

  qemu: could not open kernel file
  '/nix/store/...-linux-.../...-img-0.5.11': No such file or directory

Rename `img` to `kernelImage` so it no longer collides with a
top-level package.

The same commit also broke callers that override `kernel` with an
`aggregateModules` tree (the in-tree zfs image builders, disko), since
that has no `.target`. The single `kernel` argument was being used for
two unrelated things: the boot image for `qemu -kernel` and the module
tree for the initrd. Split the latter out into a new `kernelModules`
argument (defaulting to `kernel`), point the zfs image builders at it,
and throw a clear error explaining the migration when `kernel.target`
is missing.

nixos/lib/make-multi-disk-zfs-image.nix

@@ -262,7 +262,8 @@ let
         "virtiofs"
         "zfs"
       ];
-      kernel = modulesTree;
+      kernel = config.boot.kernelPackages.kernel;
+      kernelModules = modulesTree;
     }).runInLinuxVM
       (
         pkgs.runCommand name

nixos/lib/make-single-disk-zfs-image.nix

@@ -250,7 +250,8 @@ let
         "virtiofs"
         "zfs"
       ];
-      kernel = modulesTree;
+      kernel = config.boot.kernelPackages.kernel;
+      kernelModules = modulesTree;
     }).runInLinuxVM
       (
         pkgs.runCommand name

pkgs/build-support/vm/default.nix

@@ -30,7 +30,22 @@
   # ----------------------------
   customQemu ? null,
   kernel ? linux,
-  img ? kernel.target,
+  # Name of the kernel image file inside the `kernel` output.
+  kernelImage ?
+    kernel.target or (throw ''
+      vmTools: the `kernel` argument (${kernel.name or "<unknown>"}) has no
+      `target` attribute, so the kernel image filename cannot be determined.
+
+      If you are passing a module tree (e.g. from `pkgs.aggregateModules`) to
+      make extra modules available, pass it via `kernelModules` instead and
+      keep `kernel` pointing at a real kernel derivation. Alternatively, pass
+      `kernelImage` explicitly with the path of the bootable image relative
+      to the `kernel` derivation output (e.g. "bzImage" or "Image").
+    ''),
+  # Package providing `lib/modules` for the VM initrd. Override this (e.g.
+  # with `pkgs.aggregateModules [ ... ]`) to make extra kernel modules
+  # available inside the VM without replacing the boot kernel.
+  kernelModules ? kernel,
   storeDir ? builtins.storeDir,
   rootModules ? [
     "virtio_pci"
@@ -50,9 +65,9 @@ let
   qemu = buildPackages.qemu_kvm;
 
   modulesClosure = makeModulesClosure {
-    kernel = lib.getOutput "modules" kernel;
+    kernel = lib.getOutput "modules" kernelModules;
     inherit rootModules;
-    firmware = kernel;
+    firmware = kernelModules;
   };
 
   hd = "vda"; # either "sda" or "vda"
@@ -260,7 +275,7 @@ let
       -chardev socket,id=xchg,path=virtio-xchg.sock \
       -device vhost-user-fs-pci,chardev=xchg,tag=xchg \
       ''${diskImage:+-drive file=$diskImage,if=virtio,cache=unsafe,werror=report} \
-      -kernel ${kernel}/${img} \
+      -kernel ${kernel}/${kernelImage} \
       -initrd ${initrd}/initrd \
       -append "console=${qemu-common.qemuSerialDevice} panic=1 command=${stage2Init} mountDisk=$mountDisk loglevel=4" \
       $QEMU_OPTS