1. Baremetal. 2. It can handle 1gbps over the wan port (that's as fast as my internet goes, unable to test faster). 3. yes - not sure how hot, hasn't been a problem yet though.

I have the Kingnovy 2.5gbe one (4 i226 ports and n6005 cpu), on baremetal (128gb nvme and 16gb ram) and not using vm yet but I think you could without problems (~<25% cpu usage during speedtests -- and hardware offloading is disabled by default on opnsense), it does ~2.3gbe download/upload on a 2.5gbe plan (maybe overhead?) and 10ms bufferbloat on download/upload which is pretty good and gets an 'A' rating on waveform buffer bloat test.

It is fanless heatsink design but has fan pin for an addable fan. Hot to touch, we'll see if there's any issues.