Converge ISO Node pins on normal updates

[Drecullith]

Summary

Allow Node installed from the bundled ISO tarball to converge onto Omarchy's normal latest mise policy after first boot.

Offline ISO provisioning intentionally installs the bundled Node version with an exact global mise pin so setup can complete without network access. However, omarchy update later runs mise up, which respects that exact version and therefore never moves ISO-installed machines onto newer Node releases.

This change keeps the offline behavior intact and handles the transition during the first normal mise update:

• detect an exact Node version in the global mise config;
• require an actual retained provisioning tarball for that same version before treating the pin as Omarchy-owned;
• retarget that pin to node@latest;
• continue with the normal MISE_MINIMUM_RELEASE_AGE=0 mise up;
• record the completed policy check so later user-authored exact Node pins are left alone;
• leave the migration eligible for retry if retargeting fails.

Machines without retained ISO provisioning packages are unaffected.

An exact Node pin that does not match the bundled ISO version is also preserved.

Fixes #10820.

Tests

Added test/shell.d/update-mise-test.sh covering:

• an exact Node pin matching the bundled ISO tarball is retargeted to latest;
• the normal mise up still runs afterwards;
• a manual exact Node pin that does not match the bundled version is preserved;
• later user pins are preserved after the one-time migration check;
• non-ISO installs are untouched;
• a failed retarget does not record completion and is retried on a future update.

The focused regression suite passes locally.

Also verified:

• bash -n bin/omarchy-update-mise
• bash -n test/shell.d/update-mise-test.sh