chore(mise): pin tool versions with explicit backends

`uv` and `yq` were `latest`, and helm was declared at 3.17.3 while
ci.yaml installs v3.10.0 — so `mise run chart:lint` and the pipeline were
validating two different helm versions, and nothing said so.

Each tool is pinned on an explicit backend and checked by running it
rather than by trusting version resolution: Python 3.12.13, uv 0.13.1,
helm v3.17.3+ge4da497, yq v4.54.1.

`aqua:` for helm, yq and uv, matching the other repos in this workspace.
The `github:` backend cannot name the yq binary `yq` at all on the mise
version this repo pins, and it mis-extracts helm 3.17.x — writing the
833-byte .asc PGP signature to
installs/github-helm-helm/3.17.x/helm, with attestation and SLSA
verification both logging as passing.

helm stays on 3.17.3, matching what mise.toml already declared for the
chart. That this file and ci.yaml disagree about the version is now the
only remaining gap, and it is in the workflow, not here.

The three mise tasks parse unchanged.

mise.toml

@@ -1,8 +1,16 @@
+# Backends named and versions exact: `uv` and `yq` were `latest`, and `helm`
+# was a floating major-less spec that CI did not share — ci.yaml installs
+# v3.10.0 while this file declared 3.17.3, so local `mise run chart:lint` and
+# the pipeline that runs it were validating two different helm versions.
+#
+# `aqua:` for helm and yq, matching the other repos in this workspace. The
+# `github:` backend cannot name the yq binary `yq` at all on the mise version
+# this repo pins, and it mis-extracts helm 3.17.x.
 [tools]
-python = "3.12"
+"core:python" = "3.12"
-uv = "latest"
+"aqua:astral-sh/uv" = "0.13.1"
-helm = "3.17.3"
+"aqua:helm/helm" = "3.17.3"
-yq = "latest"
+"aqua:mikefarah/yq" = "4.54.1"
 
 [tasks.test]
 description = "Run exporter unit tests"