#3230 fix(galactica): validate and retry writer key activation

Follow-up to #3226, which merged before its review fixes reached the PR branch.

Before: the dedicated writer-key launchd job ran once without retry or a diagnostic log, and the Galactica eval test still dereferenced the removed agenix secret.

After: the job retries failed decryption at a bounded interval, writes to /var/log/kyber-writer-key.log, and the eval test checks the dedicated daemon and absence of the old agenix declaration.

Validation: nix build --no-link '.#checks.aarch64-darwin.eval-darwin-galactica', make build HOST=galactica, nixfmt, and git diff --check passed. Activation is pending this corrective merge.