Bound mise cache freshness

[junior-ricon]

Summary

• bound Template's existing mise-action cache to a UTC-day freshness epoch
• preserve the platform and mise.toml hash boundaries already used by mise-action
• scope serialized installation to the mise-action step instead of leaking MISE_JOBS=1 into tests and lints

Why

Template already caches mise installations successfully. The latest main run restored roughly 34 MiB on Ubuntu in about one second and 31 MiB on macOS in about three seconds.

The existing key is only platform plus mise.toml hash, however. Template deliberately carries floating shiv:* minor streams and an unpinned vfox-shiv plugin. Mise prefers an installed match for those fuzzy requests, so a restored cache can keep old tool/plugin versions indefinitely until mise.toml changes.

The UTC date makes the first run per platform and repository cache scope refresh normally each day while later matching runs remain warm.

Validation

• mise run test (3/3 BATS)
• all 9 configured codebase lints through the project-selected shiv:codebase@0.3
• readme build --check
• pinned actionlint 1.7.7 with ShellCheck 0.11.0
• YAML parse
• git diff --check
• signed commit verification

Hosted proof

Exact-head run 29545515443 supplied matched cold/warm attempts on both platforms:

Platform	Cold setup	Warm setup	Cold job	Warm job	Stored archive
Ubuntu	17s	2s	27s	10s	about 106 MiB
macOS	30s	4s	42s	23s	about 93 MiB

The rerun hit the exact daily platform/config keys and all checks remained green. Test duration did not regress. This PR does not change Fold and does not roll the pattern into existing tooling repositories.