registry: install opencode 2 from npm - #14295

<!-- entire-trail-link-start -->
https://entire.io/gh/jdx/mise/trails/640
<!-- entire-trail-link-end -->

### 🚀 Features

- **(bootstrap)** add apt repositories and PPAs with
[bootstrap.apt.sources] by @jdx in
[#14306](#14306)
- **(bootstrap)** embed apt source signing keys inline in .sources files
by @jdx in [#14348](#14348)
- **(bootstrap)** render templates in [bootstrap.repos] checkout paths
by @jdx in [#14359](#14359)
- **(bootstrap)** declare macOS login items by @jdx in
[#14354](#14354)
- **(bootstrap)** layer dnf packages with rpm-ostree on Fedora Atomic
hosts by @jdx in [#14357](#14357)
- **(bootstrap)** support run0 and doas for privilege elevation by @jdx
in [#14351](#14351)
- **(dotfiles)** show tracked entries that no variant selects in status
by @jdx in [#14266](#14266)
- **(dotfiles)** group mise dot status into sections by @jdx in
[#14361](#14361)
- **(github)** add oauth_copy_code to copy the device code to the
clipboard by @jdx in [#14269](#14269)
- **(github)** keep the native OAuth refresh token in a password manager
or keychain by @jdx in [#14360](#14360)
- **(http)** add libc() and avx2() template functions by @jdx in
[#14298](#14298)
- **(pypi)** read upload times from PEP 691 simple indexes by @jdx in
[#14352](#14352)
- **(rust)** download rustup-init from RUSTUP_UPDATE_ROOT by @jdx in
[#14356](#14356)

### 🐛 Bug Fixes

- **(aqua)** warn once for packages with no repo to list versions from
by @jdx in [#14336](#14336)
- **(backend)** keep decoded download file names inside the download
directory by @JamBalaya56562 in
[#14274](#14274)
- **(bootstrap)** support dnf package groups by @jdx in
[#14347](#14347)
- **(bootstrap)** don't print a stdin-only helper as a manual command by
@jdx in [#14350](#14350)
- **(bootstrap)** explain why dnf packages cannot install on ostree
hosts by @jdx in [#14353](#14353)
- **(brew)** install bottle etc files and run post_install_steps when
pouring by @jdx in [#14272](#14272)
- **(brew)** refuse to chown a prefix owned by another user by @jdx in
[#14345](#14345)
- **(brew)** preserve protected post-install copy destinations by @jdx
in [#14311](#14311)
- **(brew-cask)** support generate completions in evaluated casks by
@pmmmwh in [#14255](#14255)
- **(docker)** install libatomic1 in the Debian image so Node.js 26 runs
by @jdx in [#14303](#14303)
- **(dotfiles)** keep existing ciphertext when an encrypted file is
unchanged by @jdx in [#14300](#14300)
- **(dotfiles)** stop a newly selected profile from deleting its shared
file by @jdx in [#14275](#14275)
- **(dotfiles)** restore config entries when adopting under a symlinked
home by @jdx in [#14315](#14315)
- **(dotfiles)** show per-file diffs for directory copy entries in dot
diff by @jdx in [#14333](#14333)
- **(dotfiles)** apply mise's own config before planning the other
entries by @jdx in [#14339](#14339)
- **(go)** read an exact go line in go.mod as the toolchain version by
@jdx in [#14308](#14308)
- **(http)** retry artifact downloads started by mise exec and shims by
@jdx in [#14342](#14342)
- **(npm)** resolve unlocked latest to the npm version of a graph-locked
install by @jdx in [#14307](#14307)
- **(npm)** give unlocked requests their own install under the identity
layout by @jdx in [#14309](#14309)
- **(oci)** ignore host apt hooks when installing apt bootstrap packages
by @jdx in [#14296](#14296)
- **(packslip)** let a workflow list carry the signer pin across a
workflow move by @jdx in
[#14338](#14338)
- **(packslip)** keep a renamed project's lockfile signer under packslip
1.7 by @jdx in [#14362](#14362)
- **(prune)** keep a uv-locked pipx tool's installs for every Python by
@jdx in [#14335](#14335)
- **(prune)** keep versions of task-scoped tools by @jdx in
[#14334](#14334)
- **(schema)** accept [bootstrap.secrets] by @JamBalaya56562 in
[#14322](#14322)
- **(schema)** accept [bootstrap.groups] and [bootstrap.users] by
@JamBalaya56562 in [#14340](#14340)
- **(schema)** accept table forms for vars._.file and vars._.source by
@JamBalaya56562 in [#14383](#14383)
- **(shim)** keep other projects' command wrappers on reshim by @jdx in
[#14355](#14355)
- **(task)** bump gix so remote tasks work in git hooks by @any-victor
in [#14316](#14316)
- hide the Windows console for the tool-update service by @jdx in
[#14344](#14344)

### 🚜 Refactor

- replace serde_yaml with serde-saphyr by @jdx in
[#14328](#14328)

### 📚 Documentation

- **(bootstrap)** explain when to use --from versus --adopt by @jdx in
[#14301](#14301)
- **(bootstrap)** recommend fish = "auto" for fish shell activation by
@jdx in [#14304](#14304)
- **(dotfiles)** explain when to use sync, pull, and apply by @jdx in
[#14343](#14343)
- **(shims)** explain how to check whether a tool is installed by @jdx
in [#14337](#14337)
- switch body text to DM Sans and tighten the releases page by @jdx in
[#14302](#14302)
- self-host DM Sans and JetBrains Mono so they load on mise.jdx.dev by
@jdx in [#14310](#14310)

### 🧪 Testing

- **(bootstrap)** don't depend on bc being absent in the apt sources
test by @jdx in [#14371](#14371)

### 📦️ Dependency Updates

- install Homebrew uses_from_macos dependencies on Linux by @itskyf in
[#14288](#14288)
- bump packslip to 1.7.0 by @jdx in
[#14363](#14363)
- lock file maintenance by @renovate[bot] in
[#14320](#14320)
- update github actions by @renovate[bot] in
[#14380](#14380)
- update dependency python to v3.14.8 by @renovate[bot] in
[#14381](#14381)
- update rust crates by @renovate[bot] in
[#14382](#14382)
- update docker images by @renovate[bot] in
[#14379](#14379)

### 📦 Registry

- install opencode 2 from npm by @jdx in
[#14295](#14295)

### Chore

- **(ci)** switch to jactionlint v2 and drop zizmor by @jdx in
[#14256](#14256)
- fix CI for the aqua registry update and the unsafe-libyaml advisory by
@jdx in [#14326](#14326)

### Ci

- double the unit-macos job timeout by @jdx in
[#14346](#14346)

### Security

- **(config)** require trust for path: tool versions by @jdx in
[#14358](#14358)

### New Contributors

- @pmmmwh made their first contribution in
[#14255](#14255)
- @itskyf made their first contribution in
[#14288](#14288)

## 📦 Aqua Registry Updates

### New Packages (3)

- [`Alice39s/xmtr`](https://github.com/Alice39s/xmtr)
-
[`bufbuild/protoschema-plugins/protoc-gen-jsonschema`](https://github.com/bufbuild/protoschema-plugins)
- [`takumin/qemu-bin`](https://github.com/takumin/qemu-bin)

### Updated Packages (3)

- [`bootandy/dust`](https://github.com/bootandy/dust)
-
[`connectrpc/connect-go/protoc-gen-connect-go`](https://github.com/connectrpc/connect-go)
- [`sharkdp/hyperfine`](https://github.com/sharkdp/hyperfine)

…e it to npm (#10)

## What this changes

**The cause.** The pin bump in 588ba6f moved devvm's mise, on the host
and in VMs, from 2026.10.7 to 2026.11.3. Starting with mise 2026.10.9
(jdx/mise#14295), mise's registry puts npm first for opencode 2.x. Here
is `registry/opencode.toml` at each version:

```toml
# v2026.10.7
backends = ["aqua:anomalyco/opencode"]

# v2026.11.3
backends = [
  { full = "npm:@opencode/cli", min_version = "2.0.0", options = { allow_builds = ["@opencode/cli"] } },
  "aqua:anomalyco/opencode",
]
```

devvm named opencode only as `opencode = "2"`, so mise 2026.11.3
resolved it to `npm:@opencode/cli`. That lock entry has no download for
any platform. As a result, every resolve warned that opencode 2.2.5
isn't published for every platform, opencode's tool image couldn't be
built, and the e2e check "the shared tools resolve to upstream's newest"
failed on every machine. opencode's GitHub releases still ship v2
binaries for every platform, musl included, along with a `SHA256SUMS`.

**The fix.** `assets/shared-tools/mise.toml` now has a `[tool_alias]`
table. It names the backend of every shared tool that isn't one of
mise's own `core:` tools, so the registry's choice can't move them:

- `opencode = "github:anomalyco/opencode"`: its GitHub releases. With
mise 2026.11.3, the aqua backend now gives opencode.ai URLs, and on musl
it gives the glibc tarball. The github backend gives musl VMs opencode's
own `-musl` build and records `provenance = "github-attestations"`.
- `claude`, `codex`, `pnpm` and `uv` keep the aqua backends they already
resolve to, so their lock entries are unchanged. They are named because
each of them already lists a second backend in the registry (http, npm,
npm, and asdf/pipx). That is how opencode's switch happened.
- node, bun, python, go and rust are mise's `core:` tools. None of them
changed between 2026.10.7 and 2026.11.3, so they are not aliased.

The other two places where mise picks a backend now follow the same
table:

- The step back (`lockVersions`) locks older versions from the backend
the newest one came from.
- Each project VM's `/etc/mise/config.toml` gets the same table, sent as
`tool-alias.toml` in the setup. Without it, the VM's mise 2026.11.3
reports opencode's backend as npm, and a non-shared version would be
installed from npm.

`tests/e2e-mise.lock` was resolved again with mise 2026.11.3 through
`scripts/bump.sh e2e-tools`. It now has lockfile version 4 and opencode
from GitHub. codex stays at 0.166.0, because mise's latest for codex is
still the older 0.163.0.

**The guard.** `TestToolBackendsNamed` fails in two cases: when a shared
tool that isn't on a `core:` backend has no `[tool_alias]` entry, and
when an alias isn't the backend that `tests/e2e-mise.lock` resolved. On
main it would have failed for claude, codex, opencode, pnpm and uv. The
existing download-per-platform check (`TestE2ELockPins`) couldn't catch
this regression, because the e2e lock had never been resolved again with
2026.11.3. `TestAliases` covers the VM's table, and
`TestRefreshStepsBack` now checks the step back's `mise.toml`.

Docs: internals/images.md (Versions) explains the aliases.
contributing/maintaining.md says where a new shared tool's alias goes
and what the test checks.

Co-authored-by: Claude Opus 5.5 <[email protected]>