ci: install the stack-* cargo tools from the test environment

The import PR moved the cargo tools (nextest, llvm-cov, crap, mutants,
fuzz, udeps) from the root mise.toml to mise.test.toml, pinned, so
that EQL and protect-ffi stop inheriting them. mise loads that file
only in the test environment, so every job here that uses one now sets
MISE_ENV: test. This also fixes udeps.yml, which built the floating
`latest` cargo-udeps (0.1.61, which needs rustc 1.93) with the
runner's rustc 1.92; the test environment pins 0.1.60.

`mise run` and `mise x` install whatever tool of the toolset is
missing, and mise-action caches only what its own install step
installed. So tests-crates (rust), tests-golang (wasi-check),
crap-crates and fuzz, whose steps go through `mise run` or `mise x`,
drop `install_args` and install the whole test toolset, which then
shares one cache. mutants and udeps call their tool directly, so they
keep a narrow install.

The workflows that read mise.test.toml now list it in their path
filters.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PaY5xYydZUWhv8Nex9Sw8a

Author: auxesis

.github/workflows/crap-crates.yml

@@ -24,6 +24,7 @@ on:
       - Cargo.toml
       - Cargo.lock
       - mise.toml
+      - mise.test.toml
       - .cargo-crap.toml
       - .github/workflows/crap-crates.yml
       # Keep these excludes last so docs-only changes are skipped.
@@ -44,6 +45,12 @@ concurrency:
   cancel-in-progress: true
 
 env:
+  # The cargo tools are pinned in mise.test.toml, which mise loads only in
+  # the test environment. With no install_args, mise-action installs (and
+  # caches) the whole test toolset once: `mise run` and `mise x` install any
+  # tool of the toolset that is missing, uncached, so narrowing the install
+  # would only move the rest out of the cache.
+  MISE_ENV: test
   RUST_BACKTRACE: full
   CARGO_TERM_COLOR: always
   CARGO_NET_GIT_FETCH_WITH_CLI: true
@@ -65,7 +72,6 @@ jobs:
           version: 2026.4.0
           install: true
           working_directory: .
-          install_args: rust cargo:cargo-nextest cargo:cargo-llvm-cov cargo:cargo-crap
           cache: true
 
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
@@ -87,7 +93,6 @@ jobs:
           version: 2026.4.0
           install: true
           working_directory: .
-          install_args: rust cargo:cargo-nextest cargo:cargo-llvm-cov cargo:cargo-crap
           cache: true
 
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

.github/workflows/fuzz.yml

@@ -27,6 +27,7 @@ on:
       - Cargo.toml
       - Cargo.lock
       - mise.toml
+      - mise.test.toml
       - .github/workflows/fuzz.yml
       # Keep these excludes last so docs-only changes are skipped.
       - "!**.md"
@@ -48,6 +49,12 @@ permissions:
   contents: read
 
 env:
+  # The cargo tools are pinned in mise.test.toml, which mise loads only in
+  # the test environment. With no install_args, mise-action installs (and
+  # caches) the whole test toolset once: `mise run` and `mise x` install any
+  # tool of the toolset that is missing, uncached, so narrowing the install
+  # would only move the rest out of the cache.
+  MISE_ENV: test
   RUST_BACKTRACE: full
   CARGO_TERM_COLOR: always
   CARGO_NET_GIT_FETCH_WITH_CLI: true
@@ -80,7 +87,6 @@ jobs:
           version: 2026.4.0
           install: true
           working_directory: .
-          install_args: rust cargo:cargo-fuzz
           cache: true
 
       - name: Install the nightly toolchain (cargo-fuzz requires it)
@@ -126,7 +132,6 @@ jobs:
           version: 2026.4.0
           install: true
           working_directory: .
-          install_args: rust cargo:cargo-fuzz
           cache: true
 
       - name: Install the nightly toolchain (cargo-fuzz requires it)

.github/workflows/mutants.yml

@@ -30,6 +30,7 @@ on:
       - Cargo.toml
       - Cargo.lock
       - mise.toml
+      - mise.test.toml
       - .cargo/mutants.toml
       - .github/workflows/mutants.yml
       # Keep these excludes last so docs-only changes are skipped.
@@ -50,6 +51,12 @@ concurrency:
   cancel-in-progress: true
 
 env:
+  # The cargo tools are pinned in mise.test.toml, which mise loads only in
+  # the test environment. This job calls cargo-mutants (which runs nextest)
+  # directly, never through `mise run` or `mise x`, which would install the
+  # rest of the toolset. So mise-action installs only rust, nextest and
+  # cargo-mutants.
+  MISE_ENV: test
   RUST_BACKTRACE: full
   CARGO_TERM_COLOR: always
   CARGO_NET_GIT_FETCH_WITH_CLI: true

.github/workflows/tests-crates.yml

@@ -86,20 +86,24 @@ jobs:
       # `[target.wasm32-unknown-unknown]` rustflags in .cargo/config.toml,
       # which the stack-auth-wasm build in `node-bindings` needs.
       RUSTFLAGS: "-D warnings"
+      # nextest is pinned in mise.test.toml, which mise loads only in the
+      # test environment. See the mise-action step.
+      MISE_ENV: test
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
 
       # At the repository root: the root mise.toml pins rust 1.94.1, which the
-      # trybuild snapshots record. Only the tools this job runs are installed;
-      # the cargo: tools build from source.
+      # trybuild snapshots record. No install_args: `mise x` and `mise run`
+      # install any tool of the toolset that is missing, uncached, so this
+      # installs (and caches) the whole test toolset once. The cargo: tools
+      # build from source.
       - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
         with:
           version: 2026.4.0
           install: true
           working_directory: .
-          install_args: rust cargo:cargo-nextest
           cache: true
 
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

.github/workflows/tests-golang.yml

@@ -37,6 +37,7 @@ on:
       - Cargo.lock
       - .cargo/**
       - mise.toml
+      - mise.test.toml
       - .github/actions/require-cs-secrets/**
       - .github/workflows/tests-golang.yml
       # Keep these excludes last so docs-only changes are skipped.
@@ -58,6 +59,7 @@ on:
       - Cargo.lock
       - .cargo/**
       - mise.toml
+      - mise.test.toml
       - .github/actions/require-cs-secrets/**
       - .github/workflows/tests-golang.yml
       - "!**.md"
@@ -86,6 +88,12 @@ jobs:
     name: WASI check, guests and Go (Linux)
     runs-on: blacksmith-16vcpu-ubuntu-2204
     timeout-minutes: 60
+    env:
+      # wasm:guest:test and wasm:auth-guest:test run nextest, which is pinned
+      # in mise.test.toml. In the test environment mise-action installs (and
+      # caches) the whole test toolset, which `mise run` would otherwise
+      # install uncached.
+      MISE_ENV: test
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
@@ -96,7 +104,6 @@ jobs:
           version: 2026.4.0
           install: true
           working_directory: .
-          install_args: rust cargo:cargo-nextest go
           cache: true
 
       # The root workspace and both guest workspaces, each with its own

.github/workflows/udeps.yml

@@ -22,6 +22,7 @@ on:
       - languages/typescript/packages/stack-auth-wasm/**
       - Cargo.toml
       - Cargo.lock
+      - mise.test.toml
       - .github/workflows/udeps.yml
       # Keep these excludes last so docs-only changes are skipped.
       - "!**.md"
@@ -40,6 +41,7 @@ on:
       - languages/typescript/packages/stack-auth-wasm/**
       - Cargo.toml
       - Cargo.lock
+      - mise.test.toml
       - .github/workflows/udeps.yml
       - "!**.md"
       - "!**.example"
@@ -53,6 +55,11 @@ permissions:
   contents: read
 
 env:
+  # The cargo tools are pinned in mise.test.toml, which mise loads only in
+  # the test environment. This job calls cargo-udeps directly, never through
+  # `mise run` or `mise x`, which would install the rest of the toolset. So
+  # mise-action installs only rust and cargo-udeps.
+  MISE_ENV: test
   RUST_BACKTRACE: full
   CARGO_TERM_COLOR: always
   CARGO_NET_GIT_FETCH_WITH_CLI: true