Retry public skill-source fetches after stale GitHub OAuth credentials

[CountableNewt]

Problem

Development source sync for CountableNewt/skills failed after the merged central-skills webhook because RepoFetcher sent the account's stale GitHub OAuth token and GitHub returned 401. The repository is public, so an invalid optional credential should not prevent an anonymous tarball fetch.

Evidence:

• Webhook reached Development for refs/heads/main.
• Failed release: af60bfbb-ffa7-4926-9c5e-b324f0905da0.
• Runtime log: RepoFetcherError.fetchFailed(status: 401).

Acceptance criteria

• When an authenticated tarball request returns 401, retry once without Authorization.
• Do not broaden fallback to arbitrary failures.
• Public repositories can sync after a stale token.
• Private repositories remain inaccessible without valid credentials and fail closed.
• Add deterministic unit tests for request sequence, headers, success, and terminal failure.
• Deploy exact SHA to Development, resync the six central skills, activate the ready release, and restart the release soak.

[linear-code]

MCP-9