feat: adopt mise monorepo (config_roots, native //dir:task, per-family task_templates)

[markmals]

Summary

Makes a SpecKit repo a real mise monorepo from the first specify target add, instead of composing members with subshell cd … && mise run test.

• Generated, comment-preserving root mise.toml. monorepo_root = true + a required [monorepo].config_roots (memberDir globs like apps/*, cmd/*; mise's filesystem auto-discovery is deprecated). Merged with a real TOML library — go-toml/v2's unstable byte-range parser — so user comments, hand-pinned tool versions, and hand-added [tasks.*]/[env] survive every future target add. No managed-region markers.
• Toolchains hoist to the root [tools] from member GitHub Pillar 1: PR gating + Oxfmt/Oxlint quality + rules pack + act self-test #1. Members drop their [tools] (the apple-specific tuist stays member-level by design).
• Shared task bodies stay inline until member Richer CI annotations: verify/parity --format github (file:line) #2, then "promotion." A family's [task_templates] are written to root only once the family has a second member; existing members convert their still-canonical inline tasks to extends (a user-edited task is left inline, never silently overridden). description/depends/comments/custom tasks are preserved.
• Families: node (web), swift (apple/swift-package/swift-cli — test unified via a package_path var, fmt/lint via a superset dir walk), go (go-service).
• Native verification. Each scaffold's target.command is now mise //<dir>:test (runs with cwd = the member dir, so relative reports still resolve). Existing repos keep their recorded command — both forms remain valid.
• op → 1password (canonical mise registry name; the binary stays op).

Design: docs/design/mise-monorepo.md. Plan: docs/design/mise-monorepo-plan.md.

Implementation

Engine in internal/scaffold/monorepo.go (parseExprs/splice primitives, Family/LoadFamily, EnsureRootMise, PromoteMember); family files in internal/coreassets/templates/monorepo/{node,swift,go}.toml; CLI orchestration in cmd/specify/monorepo.go (wireMonorepo, called by target add/register).

Built task-by-task via subagent-driven development with two-stage (spec + code-quality) review on every task.

Test Plan

• mise run ci green (gofmt + build + vet + all 10 packages)
• Unit: create/merge/idempotency/comment + hand-added [tasks.*] preservation, glob derivation, promotion (stays-inline / converts-at-Richer CI annotations: verify/parity --format github (file:line) #2 / edited-task-left-inline / vars-substituted), all via re-parse checks
• Drift guards assert each family .toml body stays byte-identical to its member scaffolds' inline bodies
• E2E prove inline→promotion for node (two web), swift (cross-stack apple + swift-package), and go (two go-service)
• Mixed-family repo (node + swift + go) root-config behavior verified during final review

Known follow-up

• The per-member phase-0 mise trust is now redundant (root trust propagates) but harmless — deliberately left for a later cleanup.