chore(tooling): drop MISE_EXPERIMENTAL now that monorepo tasks are stable (mise >= 2026.7.11)

[scottschreckengaust]

Summary

MISE_EXPERIMENTAL=1 / [settings] experimental = true are set repo-wide to enable monorepo task discovery (mise //cdk:build, etc.). That feature graduated from experimental in mise #10371 (2026-06-13), which predates the repo's new min_version floor of 2026.7.11 (#887/#888). The experimental gate is therefore very likely vestigial and can be removed.

Evidence

• Monorepo namespaced tasks graduated to stable in chore: graduate stable features from experimental jdx/mise#10371 (before 2026.7.11).
• Empirically: running //cdk:eslint under mise 2026.9.8 with no experimental setting and no MISE_EXPERIMENTAL resolves and executes cleanly.
• No usage of still-experimental features (mise run --affected, workspace project graph) anywhere in .github/, mise.toml, or scripts/.

Affected places

• 6 workflows set MISE_EXPERIMENTAL: "1": build.yml, security.yml, security-pr.yml, integ.yml, dead-code-pr.yml, upgrade-main.yml.
• Root mise.toml: [settings] experimental = true and 8 inline MISE_EXPERIMENTAL=1 mise //… task prefixes (eslint/check/test/security).
• CONTRIBUTING.md: "Set export MISE_EXPERIMENTAL=1 for namespaced tasks…" and AGENTS.md common-mistakes note.

Do NOT touch (different meaning of "experimental")

node --experimental-strip-types scripts/*.ts in mise.toml — that's a Node.js flag, unrelated to mise's experimental gate.

Acceptance

• MISE_EXPERIMENTAL / experimental = true removed from configs, workflows, and docs.
• Full mise run build and the security/integ tasks pass without the flag (the real verification — must run CI, since the root config currently hardcodes it).

Notes

Behavioral change → verify with a full CI run before merge. Deliberately kept out of #888. Needs maintainer approved + assignment before implementation (ADR-003).