build: commit a mise.lock so mise-installed tools are checksum-verified #136

Follow-up from #135 (review thread on mise.toml).

Problem

mise.toml pins node, bun, cargo:hk, and now mr-boxington by version only. There is no mise.lock, so mise install does not verify the downloaded artifacts against recorded checksums. A replaced release artifact for any pinned version would be installed without notice.

Proposal

• Generate and commit mise.lock (mise lock) for every tool in mise.toml, and a platform lockfile for any platform config such as mise.macos-x64.toml.
• Raise min_version to the mise release that writes the lockfile format in use.
• Decide whether CI installs with --locked.

Out of scope

The Rust toolchain stays owned by rust-toolchain.toml.

pleaseai/shunt already does this (mise.lock + mise.macos-x64.lock, shunt#894), which can serve as the reference.