Fetch updater closures from cache.nixos.org as well as Attic

nix copy --from <attic> only pulls from that single store, so nixpkgs
deps (e.g. sqlite) that Attic skips and leaves on cache.nixos.org were
missing -> 'path is not valid'. Realize the closure through the machine's
substituters so the app comes from the dev Attic and its upstream deps
resolve from cache.nixos.org, without building from source.

radiantwave-updater.nix

@@ -56,10 +56,15 @@ in
           exit 0
         fi
 
-        # Fetch the closure from the signed Attic cache only. This never
-        # builds from source; it fails outright if the path isn't there.
+        # Realize the closure via the machine's substituters. The app itself
+        # only exists in the dev Attic cache, but nixpkgs deps (e.g. sqlite)
+        # are signed by cache.nixos.org and Attic intentionally skips them to
+        # avoid re-uploading the world. Fetch those from cache.nixos.org so
+        # the whole closure resolves without ever building from source.
         echo "radiantwave-updater: acquiring ''${NEW_PATH}"
-        ${pkgs.nix}/bin/nix copy --from "${cfg.atticUrl}" "$NEW_PATH" || {
+        ${pkgs.nix}/bin/nix-store -r "$NEW_PATH" \
+          --option extra-substituters "https://attic.radiantwavetech.com/radiantwave-dev https://cache.nixos.org" \
+          --option extra-trusted-public-keys "radiantwave-dev:B8FhLu3MQ9JfeEIHIKNrKxnP+3akzzkqMbTZR4hRfj0= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" || {
           echo "radiantwave-updater: nix copy failed for ''${NEW_PATH}"
           exit 1
         }