chore(ci): pin the mise version in jdx/mise-action instead of installing latest

[scottschreckengaust]

Summary

The 7 workflows that call jdx/mise-action pin the action by SHA (@…518 # v4.2.5) but pass no mise-version input, so each run installs the latest mise release. That's why the monorepo_root unknown-field warning (#887) never surfaced in CI — CI is always on a version ≥ the floor. For reproducibility and supply-chain determinism we may want CI to install a known mise version instead of "whatever is latest today".

Mechanism

jdx/mise-action exposes a version: input ("The version of mise to use. If not specified, will use the latest release.") and honors a MISE_VERSION env var. Example:

- uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
  with:
    cache: true
    version: 2026.7.11   # or a pinned newer version, kept in sync with mise.toml min_version

Note: mise-action does not read min_version from mise.toml to select a version — the floor is enforced by the mise binary post-install. So the action pin is an independent lever. (Also: pin to a published release — 2026.7.8–2026.7.10 were tagged but never released, so a pin to those would fail to install; 2026.7.11 is the first installable release carrying monorepo_root.)

Affected workflows

build.yml, security.yml, security-pr.yml, integ.yml, dead-code-pr.yml, upgrade-main.yml, deploy.yml (each at the jdx/mise-action step).

Open questions for triage

• Pin to an exact version (max reproducibility, needs periodic bumps — possibly via the existing upgrade-main flow) vs. leave latest (zero maintenance, non-deterministic).
• If pinned, keep it ≥ the mise.toml min_version floor and add a drift check.

Notes

Optional hardening; deliberately kept out of #888 (min_version floor fix). Needs maintainer approved + assignment before implementation (ADR-003).