Fall back from a checkout's own token only when the hub does not know it (401), never when it refuses it for permission (refs #155) 0588de69a84d

## Unreleased

- **Added: artifacts (Cylinder, step C1, #108).** `oxy artifact pack DIR --kind archive|package|container|runner-image|report [--arch --os --entrypoint --env K=V --label K=V]` packs a directory into an artifact: each file an ordinary blob of the repository's store, so files and chunks it holds already cost nothing, under a tree and an artifact encoding in canonical CBOR, named by the BLAKE3 of that encoding (docs/cylinder.md §4.1). `oxy artifact list | show NAME | unpack NAME DEST | verify NAME` (any unique prefix of six characters or more; `--json` on list, show and pack), and `oxy gc` keeps every artifact's blobs. The new `cylinder` crate holds the model.

- **Added: oxy on Haiku (#154).** oxy builds and runs on Haiku R1/beta6 (x86_64) with HaikuPorts' Rust; `oxy-VERSION-haiku-x86_64.tar.gz` is on the releases page from 0.8.0, with its own `SHA256SUMS-haiku`. The README says how to install it and how to build it (`ZSTD_SYS_USE_PKG_CONFIG=1`).

    /// `token` is the remote's own (oxygen#155), or those of enclosing

    /// checkouts when it came from the credential store (oxygen#112).

    pub fallback_tokens: Vec<String>,

}

/// Opens a store for a URL it understands, or passes (`None`). Stores that

    /// The token in use, and those still to try when it is refused.

    token: Mutex<Option<String>>,

    fallbacks: Mutex<Vec<String>>,

    repo_id: Option<[u8; 16]>,

    agent: ureq::Agent,

}

            base: base.trim_end_matches('/').to_string(),

            token: Mutex::new(options.token.clone()),

            fallbacks: Mutex::new(options.fallback_tokens.iter().rev().cloned().collect()),

            repo_id: options.repo_id,

            agent,

        })

        loop {

            let token = self.token.lock().unwrap_or_else(|p| p.into_inner()).clone();

            match self.call_once(post, endpoint, body, token.as_deref()) {

                    let next = self

                        .fallbacks

                        .lock()

        let env = std::env::var("OXY_TOKEN").is_ok_and(|t| !t.is_empty());

        let explicit = own || env;

        let stored = self.credentials().options_for(url);

        if own && !env {

            if let Some(t) = stored

                .token

                .filter(|t| options.token.as_ref() != Some(t))

            {

                options.fallback_tokens.push(t);

            }

        }

        options.token = options.token.take().or(stored.token);

        vec!["good".to_string()],

        "the parent's, to fall back on"

    );

    write(&nested, "c.txt", b"child\n");

    child.commit("child work", &[]).unwrap();

    let pushed = child.push("origin", false).unwrap();

        vec!["stale".to_string()],

        "the sign-in only"

    );

    write(&nested, "d.txt", b"more\n");

    child.commit("more", &[]).unwrap();

    let err = child.push("origin", false).err().unwrap().to_string();