build: adopt mise for pinned Go/golangci-lint/goreleaser versions

[richardcase]

Summary

• Add mise.toml pinning go (1.26.2, matching go.mod's toolchain), golangci-lint (2.13.2), and goreleaser (2.18.0) as the single source of truth for tool versions
• Replace actions/setup-go with jdx/mise-action@v4 in ci.yml, e2e.yml, and release.yml; pin golangci-lint-action/goreleaser-action to the same versions declared in mise.toml instead of floating latest
• Fix make lint to actually run golangci-lint run (previously it silently skipped this, unlike CI); add an opt-in make tools target that runs mise install
• Document mise install in the README's new "Development" section

Test plan

• mise install resolves go@1.26.2, golangci-lint@2.13.2, goreleaser@2.18.0 from mise.toml
• make build and make test pass with mise-provided go on PATH
• make lint runs golangci-lint run and reports 0 issues
• CI (ci.yml, e2e.yml) goes green on this PR with jdx/mise-action replacing setup-go

🤖 Generated with Claude Code

https://claude.ai/code/session_019mfy8FppdfMXoTmQFBaq6L

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[richardcase]

Status: `build`, `lint`, and `test` are green — these are the CI jobs this PR actually touches (replacing `actions/setup-go` with `jdx/mise-action`, pinning tool versions).

The `cloud-hypervisor` e2e job is flaking on the `echo`-based exec subtests (`exec_stdout`, sometimes `exec_shell`) with empty captured stdout, while cat-based stdin streaming, exit-code, and timeout subtests pass reliably. I reproduced the same symptom once in the plain host unit test (TestExecStdout in internal/agent, which uses an in-process net.Pipe() — no VM/vsock involved), and stress-tested it 700+ times locally (including under artificial CPU load and with -race) without reproducing it. This points to a pre-existing, environment-dependent race in internal/agent/exec.go's pipe-streaming code (untouched by this PR) that GitHub's shared runners apparently hit more often than my local machine — not something this change introduced. Flagging it as a separate issue to track/fix rather than expanding this PR's scope.

[richardcase]

Tracking the e2e flake in #17.