This does the following: * turns bootspec into a NixOS module * validates bootspecs with Cue * exposes internal knobs