upgrade-tools

# Upgrade Tools & Dependencies Bump every pinned tool and dependency in a repository to its **latest stable** version, one ecosystem at a time, validating after each so a bad bump is caught immediately. Covers the manifests this repo uses: [mise](../mise/SKILL.md) tool pins, Go modules, Python (`pyproject.toml`), OpenTofu/Terraform config, container images, [GitHub Actions](../github-actions/SKILL.md), and [dprint](../dprint/SKILL.md) plugins. ## Principles - **Latest stable only**: no RCs/betas/pre-releases (except tools intentionally range-pinned pre-1.0, e.g. `ty>=0.0.51,<0.1`). - **One ecosystem at a time**: upgrade → `mise run check` + `mise run test` → commit. Never bump everything then debug a wall of failures. - **Lockfiles are the record**: commit `mise.lock`, `go.sum`, `uv.lock`, `.terraform.lock.hcl`. The manifest says "latest"; the lockfile says "which latest". - **Validate, don't trust**: an upgrade isn't done until `mise run check` and `mise run test` pass. A green pre-existing baseline makes regressions obvious. - **Respect semver majors**: `go get -u` / `uv lock --upgrade` stay within declared majors; a major bump is a deliberate, separately-reviewed change. ## Per-Manifest Playbook ### mise — tool versions (`mise.toml`, `mise.lock`) Pins usually read `latest`; the lockfile pins the resolved version. Bump both: ```sh mise upgrade --bump # rewrites pinned versions to the newest resolved mise lock # refresh the lockfile to match installed ve...