test: check that each vland template's mise.lock locks its mise.toml

[rqbazan]

Summary

The report "vland init doesn't generate mise.lock, and the templates' CI runs mise install --locked" doesn't reproduce on main. dx#271 ships vland/templates/*/mise.lock, vland copies it verbatim (both through giget and with VLAND_TEMPLATES_DIR), and mise-action only adds --locked when a lock exists. Checked with @variablelab/vland@0.4.1 from npm.

Behaviour this PR locks in: vland init never needs or calls mise, and the project gets the template's committed lock.

vland/cli/test/integration/init-mise-lock.test.ts   (new, test-only)
  for each template
    generated mise.lock == template's mise.lock (byte-equal)
    every [tools] entry of mise.toml is locked: matching specifiers, a url per locked platform + linux-x64 (CI)
    with mise on PATH: `mise install --locked --dry-run` passes (mise isolated from the user's config)
  init with no mise on PATH succeeds and ships the lock
docs/development.md: after changing a template's mise.toml, run `mise lock` there and commit both

There's no changeset, because this only touches tests and repo docs.

Evidence

• Before, a mutation the existing tests miss: a template's mise.toml set to node = "25" with the old lock. init-templates.test.ts "pins node and pnpm" still passes, and the generated project's CI would fail with node@25 is not in the lockfile.
  After: the drift guard fails with expected [ 'node@25 is not in mise.lock' ] to deeply equal [], and the --locked oracle fails too. Running mise lock in the template dir turns it green again.
• Deleting a template's mise.lock (the reported shape) fails 5 of the 10 new tests, the --locked oracle included.
• env -i PATH=<node+pnpm only>:/usr/bin:/bin, so command -v mise finds nothing: the default vland init (install + git) exits 0 and commits a mise.lock equal to the template's.
• 10/10 new tests pass on this branch; vland's suite is 39/39.

Merge Danger

Door: two-way

Blast Radius: none

This only touches tests and repo docs, and nothing is published. The oracle test skips when mise isn't on PATH; dx CI has mise.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EZVC7xzzsEmByszmfff4u2

[changeset-bot]

⚠️ No Changeset found

Latest commit: 2827a1d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR