ci: install node and pnpm with mise

[rqbazan]

Summary

CI installs node and pnpm with mise instead of actions/setup-node + .node-version + withvariablelab/gh-actions/actions/setup-pnpm, as brand and www already do.

 Test (ci.yml) · Release, Publish preview (release.yml)
-  actions/setup-node            # node from .node-version
-  gh-actions/setup-pnpm@main    # pnpm, npm 11.21.0, store cache, pnpm install
+  jdx/mise-action@c2a8761 # v4.3.0   (install, cache)
+  pnpm install --frozen-lockfile

 mise.toml
-  node = "24.16.0"
+  node = "24"
   pnpm = "10.30.3"
+  [settings]
+  lockfile = true
+mise.lock      # node 24.21.0, pnpm 10.30.3 (same entries as brand); 7 platforms
-.node-version

• Node: 24.16.0 → 24.21.0, the version the lock pins, as in brand and env.
• mise-action pin: v4.3.0 rather than brand/www's v2.4.4. v2.4.4 targets Node 20 and GitHub force-runs it on 24 with a deprecation warning. v4.3.0 runs mise install --locked when it finds a mise.lock, and exports [env] _.path. Steps still call local binaries through pnpm.
• Unchanged: job names, actions/checkout, changesets/action, and the Release job's trigger, permissions, bot token, git user and changesets inputs.

Evidence

• Before: node 24.16.0, plus npm upgraded to 11.21.0 by setup-pnpm.
  After: node v24.21.0, npm 11.19.0 (OIDC needs ≥ 11.5.1), pnpm 10.30.3.
• Local, on the branch: pnpm install --frozen-lockfile, pnpm rr check, pnpm test and pnpm rr pack pass. The built dist/ is byte-identical to the 24.16.0 build. With the latest mise, mise install --locked passes.
• zizmor 1.30.1: no new findings. actionlint: clean.
• Release only runs on main. Its tool setup is the same as Test's. brand already publishes over OIDC with mise's node 24.
• Publish preview doesn't run from a ci/ branch. The preview label was left off on purpose.
• Known flake (already on main): pnpm rr check sometimes fails with TS2307 on vitest.config.ts imports (1 of 15 local runs on main). A re-run clears it.

Merge Danger

Door: two-way

Reverting the commit restores the setup actions and node 24.16.0.

Blast Radius: CI

If the new setup failed in Release, the next push to main wouldn't open or publish a version PR until it's fixed or reverted.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LaXH7RYzcisshRN2aay5dZ

[changeset-bot]

⚠️ No Changeset found

Latest commit: 7e03ce3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR