[BUG] apm marketplace add silently fails for private repos

[richard-fowles-epam]

Describe the bug
apm marketplace add OWNER/REPO always fails silently when the marketplace repo is private. The command reports No marketplace.json found even when the file exists and the user has valid credentials.

To Reproduce

1. Have a private GitHub repo containing a valid marketplace.json at the root
2. Ensure you have valid credentials with repo scope (e.g. via gh auth login)
3. Run apm marketplace add <owner>/<private-repo> --verbose
4. See error: No marketplace.json found in '<owner>/<private-repo>'

Expected behavior
apm marketplace add should successfully register the marketplace using the authenticated user's credentials, and report the number of plugins found.

Environment

• OS: macOS
• APM Version: 0.8.11

Logs

[*] Registering marketplace 'my-marketplace'...
    Repository: owner/private-repo
    Branch: main
[x] No marketplace.json found in 'owner/private-repo'. Checked: marketplace.json, .github/plugin/marketplace.json, .claude-plugin/marketplace.json

Additional context
The file is accessible via gh api with the same credentials, confirming it is an authentication issue in the apm CLI rather than a missing file.

[sergio-sisternes-epam]

Starting work on the changelog update for this fix. I’m adding the CHANGELOG.md entry under ## [Unreleased] for PR #701.

[sergio-sisternes-epam]

Completed the changelog update in CHANGELOG.md.

Added a ## [Unreleased] → ### Fixed entry for the private-repo authentication fix in apm marketplace add, ending with (#701). Validated with head -30 CHANGELOG.md.

[sergio-sisternes-epam]

Confirmed this is fixed in PR #701. Tested apm marketplace add against a private GitHub repository containing a valid marketplace.json -- the command now correctly authenticates and registers the marketplace (73 plugins detected).

The root cause was that _fetch_file() used unauth_first=True when calling AuthResolver.try_with_fallback(). For private repos, GitHub returns 404 (not 403) to unauthenticated requests, and the code treated that as "file not found" without ever retrying with credentials. The fix switches to unauth_first=False so credentials are used on the first attempt when available.