build(deps): bump mise-action to v5.1.1

[bketelsen]

Summary

Replace Dependabot #83 (v5.0.0) with the latest 5.x release, jdx/mise-action v5.1.1, pinned to 2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca using the existing SHA + version-comment style.

• Updated every workflow use: repository-wide workflow search found one, in .github/workflows/ci.yml.
• Includes the cached-binary verification fix introduced in v5.0.1: verify before execution; discard and reinstall on failure.
• Reviewed v5.1.1's opt-in GitHub token persistence change: later steps run already-installed golangci-lint and do not need the token. Existing inputs and least-privilege permissions remain unchanged.
• High-risk protected surface: .github/workflows/ci.yml; requires Brian's review and merge.

Checks

• make check (via mise exec -- make check) — formatting, pinned lint, unit/e2e tests, coverage checker self-tests and coverage floor passed (97.5%). Initial attempt needed local mise trust; rerun passed.
• go test -race -short ./... (via mise) passed.
• go.mod unchanged and dependency-free.
• No application behavior changes; action-runtime verification is left to hosted CI.

Docs housekeeping

Existing documentation reviewed; no project API, conventions, or documentation changes needed for this action dependency bump. Conformance aliases untouched.

Verification

• node scripts/check-docs.mjs passed (12 docs, 155 links, 9 symlinks).
• git diff --check passed; only the action pin and version comment changed.
• Verified v5.1.1 tag resolves directly to the pinned commit using GitHub's git-ref API, and reviewed upstream release notes.