Converge ISO Node pins on normal updates - #10878

Summary

Migrate legacy offline-ISO Node pins onto Omarchy's normal latest mise policy during a regular update.

Older offline ISO provisioning wrote the bundled Node version into the user's global mise config as an exact pin so setup could complete without network access. Those already-installed machines remain frozen on that exact version because omarchy update runs mise up, which respects the configured range.

Upstream #11656 now prevents new offline installs from retaining the exact pin: after registering the bundled Node version, provisioning rewrites the configured policy to latest.

This PR complements that fix by handling the existing installed base. mise-work.sh does not run again on machines that were already provisioned, so those legacy exact pins otherwise remain unchanged.

During the first normal mise update, this change:

• detects an exact Node version in the global mise config;
• requires a retained Omarchy provisioning tarball for that same version before treating the pin as Omarchy-owned;
• retargets that pin to node@latest;
• continues with the normal MISE_MINIMUM_RELEASE_AGE=0 mise up;
• records the completed policy check so later user-authored exact Node pins are left alone;
• leaves the migration eligible for retry if retargeting fails.

Machines without retained ISO provisioning packages are unaffected.

An exact Node pin that does not match the retained bundled ISO version is also preserved.

Together, #11656 and this PR cover both sides of the lifecycle:

• new offline installs stop retaining the exact pin at provisioning time;
• machines already installed from older ISOs converge during a normal omarchy update.

Fixes #10820.

Why this still matters after #11656

#11656 changes the provisioning path only. It does not revisit user configuration already written on installed systems.

Issue #10820 has a confirmed example of an existing ISO-installed machine whose retained provisioning tarball still matches its exact Node pin. On that class of machine, this migration path would identify the pin as Omarchy-owned and safely retarget it without treating unrelated user pins as migration candidates.

Tests

Added test/shell.d/update-mise-test.sh covering:

• an exact Node pin matching the bundled ISO tarball is retargeted to latest;
• the normal mise up still runs afterwards;
• a manual exact Node pin that does not match the bundled version is preserved;
• later user pins are preserved after the one-time migration check;
• non-ISO installs are untouched;
• a failed retarget does not record completion and is retried on a future update.

The focused regression suite passes locally.

Also verified:

• bash -n bin/omarchy-update-mise
• bash -n test/shell.d/update-mise-test.sh