The existing test runs mise-work.sh in the runtime context, which skips
the bundled tarball altogether. This offers both tarballs to an x86_64
and an aarch64 machine and checks that each unpacks its own and hands
Mise that version, and that a machine with only the other architecture's
tarball fails. Against the old script the aarch64 case fails.
* Remove unsafe project bin PATH injection
* Cover customized unsafe Mise paths
* Revoke legacy Mise Work trust
* Harden legacy Mise trust cleanup
* Preserve ignored Mise Work configs
* Scope Mise path cleanup to env
* Accept paranoid Mise ignore marker
Reported-by: infosec-us-team
Emir Beganovic