The nvim-config remote is git@github.com, and the SSH key lives in the login shell's ssh-agent, which launchd jobs don't see. launchd's own agent has no keys, so every scheduled pull failed with "Permission denied (publickey)". The repo is public, so rewrite GitHub SSH URLs to HTTPS for this job through GIT_CONFIG_* variables. The checkout's remote stays SSH for interactive use.