chore(deps): update github-actions to df4cb1c (#136)

This PR contains the following updates:

| Package | Change | Type | Update |
|---|---|---|---|
| [jdx/mise-action](https://redirect.github.com/jdx/mise-action) |
[`v4.0.1` ->
`v4.2.0`](https://redirect.github.com/jdx/mise-action/compare/v4.0.1...v4.2.0)
| action | minor |

---

### Release Notes

<details>
<summary>jdx/mise-action (jdx/mise-action)</summary>

###
[`v4.2.0`](https://redirect.github.com/jdx/mise-action/releases/tag/v4.2.0):
: Bootstrap mode & wget fallback

[Compare
Source](https://redirect.github.com/jdx/mise-action/compare/v4.1.0...v4.2.0)

This release adds an opt-in **bootstrap mode** for projects that use
`mise bootstrap`, and makes the action work on runner images that ship
`wget` but not `curl`.

#### Added

##### Bootstrap mode
([#&#8203;522](https://redirect.github.com/jdx/mise-action/pull/522)) by
[@&#8203;jdx](https://redirect.github.com/jdx)

Three new inputs let the action drive `mise bootstrap` instead of `mise
install`:

```yaml
- uses: jdx/mise-action@v4
  with:
    bootstrap: true
    bootstrap_skip: "tools,task"   # comma-separated parts to skip
    bootstrap_args: "--yes"        # extra args forwarded to mise bootstrap
```

- When `bootstrap: true`, the action runs `mise bootstrap` under the
existing `install` gate and sets `MISE_EXPERIMENTAL=1` automatically.
- If a repo mise lock file is present, it runs `mise --locked
bootstrap`, matching the auto-lock behavior introduced for `mise
install` in v4.1.0.
- `install_args` cannot be combined with `bootstrap: true` — the action
fails fast and tells you to use `bootstrap_skip` / `bootstrap_args`
instead, because full bootstrap doesn't support partial tool install
args.
- A new `{{bootstrap_hash}}` template variable is included in the
default cache key (and available in custom `cache_key` templates) so
bootstrap and non-bootstrap configurations don't share caches.

`bootstrap_skip` relies on `mise bootstrap --skip` from
[jdx/mise#10497](https://redirect.github.com/jdx/mise/pull/10497), so
make sure you're on a recent mise version if you use it.

#### Fixed

- **Fall back to `wget` when `curl` is unavailable**
([#&#8203;521](https://redirect.github.com/jdx/mise-action/pull/521)) by
[@&#8203;risu729](https://redirect.github.com/risu729) — The action used
to hard-code `curl` for fetching the mise binary, tar/zip archives, and
the latest `VERSION` lookup, which broke on minimal runner images that
only ship `wget`. It now prefers `curl` and transparently falls back to
`wget`, preserving the streaming `download | tar` fast path for
`.tar.gz` and `.tar.zst` installs on Linux/macOS. Proxy support is
unchanged — both tools honor `HTTP_PROXY`/`HTTPS_PROXY`. Addresses
[jdx/mise#10488](https://redirect.github.com/jdx/mise/issues/10488).

#### Documentation

- Link the known Rust cache interaction note from the README
([#&#8203;496](https://redirect.github.com/jdx/mise-action/pull/496)) by
[@&#8203;risu729](https://redirect.github.com/risu729).

**Full Changelog**:
<jdx/mise-action@v4.1.0...v4.2.0>

###
[`v4.1.0`](https://redirect.github.com/jdx/mise-action/releases/tag/v4.1.0):
: automatic --locked installs

[Compare
Source](https://redirect.github.com/jdx/mise-action/compare/v4.0.1...v4.1.0)

This release adds automatic locked installs when a `mise.lock` is
present, and fixes a long-standing cache-key collision that could poison
tool installs when workflows migrate between runner providers.

##### Added

##### Automatic `--locked` install when `mise.lock` exists
([#&#8203;495](https://redirect.github.com/jdx/mise-action/pull/495)) by
[@&#8203;zeitlinger](https://redirect.github.com/zeitlinger)

When a repo contains `mise.lock`, the action now automatically passes
`--locked` to `mise install` (on mise versions that support it). This
removes the need to manually set `install_args: --locked` and prevents
`mise install` from silently mutating the lockfile in CI. Explicit
`install_args` and older mise versions are still respected.

Note: workflows with a stale lockfile may now fail earlier and more
explicitly instead of silently updating `mise.lock` mid-run — this
surfaces lockfile drift rather than hiding it.

##### Fixed

- **Cache key collisions across runner providers**
([#&#8203;456](https://redirect.github.com/jdx/mise-action/pull/456)) —
the default cache key now includes the runner image (e.g. `macos15`,
`ubuntu24` for GitHub-hosted runners; `self-hosted` otherwise).
Previously, repos migrating between providers like github-hosted,
namespace.so, BuildJet, and self-hosted runners with the same OS/arch
could restore a peer provider's `~/.local/share/mise/installs/*`,
causing failures like `does not have an executable named '…'` or SIGILL
crashes from binaries built against a different glibc/CPU featureset.
Expect a one-time cache miss after upgrading; thereafter the cache stays
scoped per image.
- **`mise-shim.exe` missing on Windows**
([#&#8203;476](https://redirect.github.com/jdx/mise-action/pull/476)) by
[@&#8203;risu729](https://redirect.github.com/risu729) — the action now
installs `mise-shim.exe` alongside `mise.exe` and repairs restored
caches that lack the shim. Fixes
[#&#8203;475](https://redirect.github.com/jdx/mise-action/issues/475).

##### Changed

- Migrated the bundled action build from ncc (CommonJS) to Rollup (ESM)
([#&#8203;436](https://redirect.github.com/jdx/mise-action/pull/436)).
No user-facing behavior change.

**Full Changelog**:
<jdx/mise-action@v4.0.1...v4.1.0>

</details>

---

### Configuration

📅 **Schedule**: (in timezone America/Los_Angeles)

- Branch creation
  - "after 4pm on thursday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/scottames/daggerverse).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMDkuNCIsInVwZGF0ZWRJblZlciI6IjQzLjI0Mi4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Author: renovate[bot]

.github/workflows/dagger-update.yaml

@@ -44,7 +44,7 @@ jobs:
           permission-contents: write # create releases
           permission-pull-requests: write # create release pull requests
       - name: install mise
-        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
         with:
           install: true
           cache: true

.github/workflows/pr_mise_lock.yaml

@@ -38,7 +38,7 @@ jobs:
           permission-contents: write # create releases
           permission-pull-requests: write # create release pull requests
       - name: install mise
-        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
         env:
           MISE_LOCKED: 0 # disable "locked=true" for update
         with: