Pin the mise version in the four CI steps that take the newest release

[auxesis]

Four steps that set up mise in CI do not pin the mise version. Each one picks up every new mise release on its next run. A new mise release can then break CI with no change in this repository.

This has already happened once

mise 2026.10.0 came out on 2 October 2026. It refuses to install a cargo: tool, such as cargo:cargo-zigbuild, until the Rust version in the root mise.toml is installed. That broke both gnu builds of protect-ffi in _build-ffi-artifacts.yml. #1027 fixed it by pinning mise 2026.4.0 there, which is the version most other steps in this repository already pin.

These four steps still take the newest mise

File	What the step installs	Why it works today
.github/workflows/integration-protect-ffi.yml	everything, with a bare mise install	it installs Rust first
.github/workflows/tests-rust.yml	everything, with a bare mise install	it installs Rust first
.github/actions/build-auth-binding/action.yml	aqua:wasm-bindgen/wasm-pack	it installs no cargo: tool
.github/actions/build-ffi-binding/action.yml	aqua:wasm-bindgen/wasm-pack	it installs no cargo: tool

All four pass on main today.

Fix

1. Pin version: 2026.4.0 on each of the four steps, as the other jdx/mise-action steps do.
2. Add a test in scripts/__tests__/ that fails when any jdx/mise-action step has no version.
3. Decide how the pinned version gets updated, for example through Dependabot or a scheduled check.