v2026.11.1: npm provenance verified by default, with repository pins in mise.lock
npm: tools now have their Sigstore provenance verified by default. The first install records the repository that built the package in mise.lock, and later installs must come from that same repository. This release also adds named environment sets in miserc.toml and fixes a range of lockfile, install and shell issues. See Breaking Changes before you upgrade: some installs that worked before can now…