fix: pin aube + note mise recursion fork bomb

[natevick]

Pins npm:@endevco/aube to an exact version. Resolving "latest" for an npm-backend tool makes mise shell out to npm view <pkg> dist-tags --json; on a pre-fix mise, npm inside that child resolves back to the mise shim and re-enters resolution. On 2026-08-12 that recursed 2,829 levels deep and OOM'd a 60Gi box twice.

The real fix is upstream — jdx/mise#8475, "strip mise shims from dependency_env PATH to prevent fork bomb". The affected machine was on 2026.2.17, six months behind it, and has been self-updated to 2026.8.5 (above the MISE_MIN this repo now declares). The pin stays as belt-and-braces: an exact version needs no registry lookup at all.

Evidence

• Mechanism, from a snapshot taken mid-storm: 2,828 of 2,829 npm view processes had another npm view as their parent — recursion, not fan-out. All 2,839 matching processes were the dist-tags (latest-version) call; not one was versions. The pin removes exactly that call.
• Failed-then-passed: mise outdated on a cold cache emitted the dist-tags call before the pin, and zero after — with 130 DEBUG lines confirming a real run rather than an error short-circuit.
• Post-upgrade smoke test: cold cache, contained in a pids+memory-capped cgroup → npm view=0, exit 0.
• Regression check: node/npm/ruby/python/aube all resolve correctly after the 6-month mise jump; mise ls reports no errors.

What this does not establish

The recursion was never reproduced in isolation — it needed a PATH condition I couldn't recreate on demand, so the upgrade is verified installed and the fix is documented upstream, but not demonstrated-gone by execution here. That asymmetry is why the pin stays rather than reverting to "latest" on the strength of the upgrade alone.

[natevick]

Superseded: the real fix was upstream. mise on the affected box was 2026.2.17, six months before jdx/mise#8475 ("strip mise shims from dependency_env PATH to prevent fork bomb"); it has been self-updated to 2026.8.5, above the MISE_MIN install-mise.sh already enforces. Verified by execution: with aube back on "latest" and a cold cache, 2026.8.5 resolves the version over HTTP and spawns zero npm view subprocesses, so the recursion has no seed. No repo change needed — closing with an empty diff.