ci: use strict lockfile mode and regenerate mise.lock (#2975)
mise upgraded its lockfile serialization format, causing mise.lock to
be rewritten on every install -- dirtying the tree in CI and locally.
Regenerate the lockfile with the current format and enable MISE_LOCKED=1
in all CI workflows so mise reads the lockfile without rewriting it.
This replaces the git-checkout workaround added in #2964.
