add --refresh to nix profile add in self-update so it bypasses nix's own tarball-ttl cache, not just the narHash-pinned originalUrl

@@ -442,7 +442,12 @@442442             output.updateSelfNixFailed();443443             return;444444         }445-        const add_r = exec.capture(ctx.gpa, ctx.io, &ctx.machine, &.{ "nix", "profile", "add", "--no-write-lock-file", FLAKE_URL }) catch {445+        // Even against the plain unpinned URL, nix caches its resolution for446+        // `tarball-ttl` seconds (default 3600) regardless of HTTP cache-control447+        // headers — so within an hour of any prior nix operation touching this448+        // URL, add would silently reuse the stale narHash and reinstall the449+        // same old version. --refresh forces nix to actually re-check HEAD.450+        const add_r = exec.capture(ctx.gpa, ctx.io, &ctx.machine, &.{ "nix", "profile", "add", "--no-write-lock-file", "--refresh", FLAKE_URL }) catch {446451             output.updateSelfNixReinstallFailed();447452             return;448453         };