agent trust bundle: retry the root fetch inside its start job so a dns blip at boot queues the harness instead of failing it

nix/script-tests/retry-in-job.nix

@@ -0,0 +1,18 @@
+# `checks.script-test-retry-in-job` — runs ../host-modules/lib/retry-in-job.nix's
+# `retry_in_job` against a command that fails a set number of times. The cases
+# are in ./retry-in-job.sh.
+#
+# What runs is the rendered helper, sourced as the trust-bundle unit's script
+# includes it.
+{
+  pkgs,
+  ...
+}:
+pkgs.runCommand "hyperhive-script-test-retry-in-job"
+  {
+    HELPER = pkgs.writeText "retry-in-job.sh" (import ../host-modules/lib/retry-in-job.nix { });
+  }
+  ''
+    ${pkgs.bash}/bin/bash ${./retry-in-job.sh}
+    touch "$out"
+  ''