Fix remote-build bootstrap: retry on partial failure, fix sudo-less root Nix install

Two bugs found running scripts/create-proxmox-resource.sh against a real
Proxmox node for the first time:

- The Nix installer's single-user root path still shells out to `sudo`
  to create /nix even though it already detected it's running as root,
  which fails outright on a minimal, sudo-less Debian/Proxmox node.
  codex-setup.sh now pre-creates /nix itself so that branch of the
  installer is skipped.

- ensure_remote_repo() only ran scripts/codex-setup.sh right after a
  fresh git clone, so a bootstrap that cloned the repo but then failed
  installing Nix (exactly the failure above) left every subsequent run
  silently building with a `nix` that was never actually installed,
  since the repo already existing skipped tooling setup entirely. It
  now checks `command -v nix` (via the same ensure_nix_profile used
  elsewhere, since a non-interactive ssh session won't otherwise have a
  single-user install on PATH) on every run and re-bootstraps if it's
  missing. Both remote build heredocs also now source
  scripts/lib/nix-bootstrap.sh themselves for the same PATH reason.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/codex-setup.sh

@@ -41,6 +41,17 @@ warn-dirty = false
 build-users-group = nixbld
 EOF
 
+    # The official installer's single-user root path still shells out to
+    # `sudo` to create /nix even though it already knows it's running as
+    # root -- confirmed live against a sudo-less minimal Debian/Proxmox
+    # node, where it fails with "sudo: not found" and prints this exact
+    # mkdir/chown as the manual fix. Pre-create it so that branch of the
+    # installer is skipped entirely.
+    if [ ! -d /nix ]; then
+      mkdir -m 0755 /nix
+      chown root /nix
+    fi
+
     sh <(curl -L https://nixos.org/nix/install) --no-daemon
   else
     sh <(curl -L https://nixos.org/nix/install) --no-daemon