feat(launcher): enforce GitHub 403 retry for nix run

- Require retry_403.sh to exist and fail hard if missing
- Source retry helper unconditionally
- Run nix flake execution via run_with_github_403_retry
- Prevent transient GitHub API rate-limit failures during nix run

https://chatgpt.com/share/693ed83e-a2e8-800f-8c1b-d5d5afeaa6ad

scripts/launcher.sh

@@ -2,6 +2,19 @@
 set -euo pipefail
 
 FLAKE_DIR="/usr/lib/package-manager"
+NIX_LIB_DIR="${FLAKE_DIR}/nix/lib"
+RETRY_LIB="${NIX_LIB_DIR}/retry_403.sh"
+
+# ---------------------------------------------------------------------------
+# Hard requirement: retry helper must exist (fail if missing)
+# ---------------------------------------------------------------------------
+if [[ ! -f "${RETRY_LIB}" ]]; then
+  echo "[launcher] ERROR: Required retry helper not found: ${RETRY_LIB}" >&2
+  exit 1
+fi
+
+# shellcheck source=/usr/lib/package-manager/nix/lib/retry_403.sh
+source "${RETRY_LIB}"
 
 # ---------------------------------------------------------------------------
 # Try to ensure that "nix" is on PATH (common locations + container user)
@@ -32,10 +45,10 @@ if ! command -v nix >/dev/null 2>&1; then
 fi
 
 # ---------------------------------------------------------------------------
-# Primary path: use Nix flake if available
+# Primary path: use Nix flake if available (with GitHub 403 retry)
 # ---------------------------------------------------------------------------
 if command -v nix >/dev/null 2>&1; then
-  exec nix run "${FLAKE_DIR}#pkgmgr" -- "$@"
+  exec run_with_github_403_retry nix run "${FLAKE_DIR}#pkgmgr" -- "$@"
 fi
 
 echo "[launcher] ERROR: 'nix' binary not found on PATH after init."