Pin bin/ci's tool versions in .mise.toml (#649)

bin/ci fails cold in a fresh worktree: mise shims for actionlint, shellcheck,
and pwsh exist machine-wide but no version is pinned for this project, so each
one dies with "No version is set for shim". shellcheck isn't even invoked by
the repo directly — actionlint shells out to it to lint workflow run: blocks,
so the broken shim takes actionlint down with it. zizmor is worse than
unpinned: make lint-actions hard-fails without it and make tools can't install
it (brew/pacman only).

Pin all four in [tools] so mise install makes bin/ci self-sufficient:

* actionlint 1.7.12 — matches the .github/workflows/test.yml action pin
* shellcheck 0.11.0 — actionlint's dependency; CI uses the runner's preinstall
* powershell 7.6.5 — no CI pin to mirror (runners preinstall pwsh); turns the
  three fail-closed-in-CI installer.bats pwsh tests into locally-running tests
* zizmor 1.29.0 — also pinned via the workflow's version input, matching what
  CI already ran: the action resolves its version (including the "latest"
  default) through a digest map checked in at its pinned SHA, where "latest"
  maps to 1.29.0. The explicit pin keeps the release from shifting when the
  action SHA is bumped and keeps local bin/ci on the same analyzer as CI.

Each pin carries a sync comment mirroring the existing goreleaser convention.

Author: jeremy

.github/workflows/test.yml

@@ -95,6 +95,11 @@ jobs:
       - name: Run zizmor
         uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
         with:
+          # The action resolves `version` (default "latest") through the digest
+          # map checked in at its pinned SHA, so this stays stable either way —
+          # the explicit pin keeps the release from shifting when the action SHA
+          # is bumped, and matches the .mise.toml zizmor pin for local parity.
+          version: "1.29.0"
           advanced-security: false
 
   security:

.mise.toml

@@ -2,3 +2,14 @@
 go = "1.26"
 # Keep in sync with .github/workflows/release.yml GoReleaser CLI version pin.
 goreleaser = "2.15.4"
+# Keep in sync with .github/workflows/test.yml rhysd/actionlint version pin.
+actionlint = "1.7.12"
+# Not invoked directly; actionlint shells out to it to lint workflow `run:`
+# scripts (CI uses the runner's preinstalled shellcheck).
+shellcheck = "0.11.0"
+# No CI pin to match; runners preinstall pwsh. Lets e2e/installer.bats pwsh
+# tests run locally instead of skipping.
+powershell = "7.6.5"
+# Keep in sync with the zizmor-action `version:` input in
+# .github/workflows/test.yml so local bin/ci runs the same release CI does.
+zizmor = "1.29.0"