ci: install cargo-zigbuild from release binaries

[pimlock]

Summary

Switch cargo-zigbuild from mise's Cargo installer backend to the upstream GitHub release binary backend. This avoids compiling cargo-zigbuild while building the CI image.

Related Issue

Follow-up to #1490. Addresses the CI image build failure seen in https://github.com/NVIDIA/OpenShell/actions/runs/26307047083/job/77447174837.

Changes

• Replace cargo:cargo-zigbuild with github:rust-cross/cargo-zigbuild in mise.toml.
• Regenerate mise.lock with prebuilt cargo-zigbuild assets for linux-x64, linux-arm64, and macos-arm64.
• Keep the same cargo-zigbuild version, 0.22.3.

This approach is better for the CI image because mise install --locked can download and verify upstream release binaries instead of compiling cargo-zigbuild at image-build time. Building it from source requires the Rust toolchain and RUSTC_WRAPPER/sccache configuration to already be correct during tool installation, which is exactly what failed in the CI image build.

Testing

• mise run pre-commit passes
• git diff --check passes
• mise install --locked github:rust-cross/cargo-zigbuild@0.22.3 downloads the prebuilt binary
• mise x -- cargo zigbuild --help runs successfully

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-1533.docs.buildwithfern.com/openshell