ci(nix): auth github fetches + retry to survive transient 5xx
Add `access-tokens = github.com=${GITHUB_TOKEN}` so Nix's flake-input
fetches use the authenticated (higher) rate limit, and retry `nix build`
once — the previous failure was a transient GitHub tarball-API 503, not a
flake problem.