Enable live app updater on production variants

All variants now follow the same update procedure as the dev flakes;
prod variants pull the RadiantWave binary, Attic repo, and manifest
from the radiantwave channel instead of radiantwave-dev.

radiantwave-updater.nix

@@ -61,18 +61,18 @@ in
           exit 0
         fi
 
-        # Realize the closure via the machine's substituters. The app itself
-        # only exists in the dev Attic cache, but nixpkgs deps (e.g. sqlite)
-        # are signed by cache.nixos.org and Attic intentionally skips them to
-        # avoid re-uploading the world. Fetch those from cache.nixos.org so
-        # the whole closure resolves without ever building from source.
-        # --add-root pins the fetched closure so GC can't collect it while
-        # the swap below makes it live.
+        # Realize the closure via the variant's Attic cache plus cache.nixos.org.
+        # nixpkgs deps (e.g. sqlite) are signed by cache.nixos.org and Attic
+        # intentionally skips them to avoid re-uploading the world, so fetch
+        # them from cache.nixos.org and the whole closure resolves without ever
+        # building from source. Trusted public keys come from the system config
+        # (both Attic repos are trusted in configuration.nix). --add-root pins
+        # the fetched closure so GC can't collect it while the swap below makes
+        # it live.
         echo "radiantwave-updater: acquiring ''${NEW_PATH}"
         ${pkgs.nix}/bin/nix-store -r "$NEW_PATH" \
           --add-root /var/lib/radiantwave/.current-root \
-          --option extra-substituters "https://attic.radiantwavetech.com/radiantwave-dev https://cache.nixos.org" \
-          --option extra-trusted-public-keys "radiantwave-dev:B8FhLu3MQ9JfeEIHIKNrKxnP+3akzzkqMbTZR4hRfj0= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" || {
+          --option extra-substituters "${cfg.atticUrl} https://cache.nixos.org" || {
           echo "radiantwave-updater: nix copy failed for ''${NEW_PATH}"
           exit 1
         }