We need to ensure that in case of network / nixos.org / GitHub issues, flake-based builds still work if at all possible. In particular:

• If we can't get the latest flake registry from nixos.org, we should continue with the most recently fetched copy of the registry (regardless of the tarball-ttl setting). This also means the registry should be a GC root.

• If we can't get the latest version of a mutable flake, we should continue with the most recently fetched version. For immutable flakes, we never have to refetch, so as long as we still have it (see Support private files in the Nix store #8), we should be good.