ci: pin chezmoi version instead of installing latest via brew

[laurigates]

What

CI installs chezmoi at whatever version Homebrew currently ships. Pin it to a specific version, and change that version deliberately when upgrading.

Why

A chezmoi release broke main without any change in this repo. chezmoi ≥2.72 started rejecting leading-slash patterns in .chezmoiignore as invalid path. According to #364, Build (Ubuntu) failed on every commit from 2026-08-04 until #364 merged on 2026-08-18. /justfile had been in the file since #308 and had passed CI for a month. The report in #377 came from the same break.

Install sites in .github/workflows/smoke.yml at main (caf1566):

• line 35: brew install chezmoi
• line 70: brew install chezmoi neovim zsh
• line 185: brew install chezmoi neovim

#364 suggested pinning to match mise, but that gives no pin. private_dot_config/mise/config.toml.tmpl:143 is chezmoi = "latest", so local machines also get whatever release is newest.

How

Options, not yet decided:

1. Install a pinned release in CI, e.g. a chezmoi GitHub release binary with a version and checksum, or mise with aqua:twpayne/chezmoi@<version>. Keep one version string that all three jobs share.
2. Pin the same version in the mise config so local and CI match (see local-ci-parity). Let Renovate or Dependabot propose bumps, so upgrades arrive as PRs that run the build.

Acceptance:

• All three CI install sites use the same pinned version.
• A chezmoi upgrade reaches CI only through a PR that changes that version.

Version to pin: v2.72.1 is the current local version and passes chezmoi managed against main.

🤖 Generated with Claude Code

https://claude.ai/code/session_019fNoNLmJDB9gCTkAszkzaV