fix(mise): make the wasi-check dependency gate see through colour

wasm:wasi-check greps cargo tree output for crates that must never link
into a WASI guest (wasm-bindgen, web-sys, js-sys, reqwest, hyper,
aws-lc-sys). CI sets CARGO_TERM_COLOR=always, so cargo wraps each line's
tree prefix in ANSI colour codes, and the grep, which anchors on that
prefix, can never match. A deliberate-break run on 2 October 2026 added
wasm-bindgen to stack-kms, and the CI step still printed "all WASI
crates compile with no JS-host or native-HTTP deps". Only the cargo
check half of the step was working.

Ask cargo tree for --color never. With CARGO_TERM_COLOR=always, the gate
now fails on that break and passes on the clean tree. A script test
checks every cargo tree call in the task asks for uncoloured output, and
records why with a coloured sample the patterns cannot match.

cipherstash-suite has the same task and the same CI setting, so its gate
is dead too.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PaY5xYydZUWhv8Nex9Sw8a

Author: auxesis

mise.toml

@@ -95,7 +95,9 @@ check() {
   # cargo tree can die on EPIPE, and pipefail would adopt that status —
   # silently masking a MATCH once the tree outgrows the pipe buffer.
   local tree
-  tree=$(cargo tree --target wasm32-wasip1 -e normal -p "$crate" "$@")
+  # --color never: CI sets CARGO_TERM_COLOR=always, and the colour codes
+  # around the tree prefix stop the grep below from ever matching.
+  tree=$(cargo tree --color never --target wasm32-wasip1 -e normal -p "$crate" "$@")
   if grep -Eq '^[^a-z]*(wasm-bindgen|web-sys|js-sys) ' <<<"$tree"; then
     echo "error: $crate pulls a JS-host backend (wasm-bindgen/web-sys/js-sys) on WASI — not wazero-loadable" >&2
     exit 1

scripts/__tests__/wasi-check-gate.test.mjs

@@ -0,0 +1,46 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { REPO_ROOT } from './lib/repo-root.mjs'
+
+/**
+ * `wasm:wasi-check` greps `cargo tree` output for crates that must never link
+ * into a WASI guest. CI sets `CARGO_TERM_COLOR=always`, and cargo then wraps
+ * each line's tree prefix in ANSI colour codes. The grep anchors on that
+ * prefix, so with colour on it can never match: the gate passed with
+ * `wasm-bindgen` added to stack-kms in a deliberate-break run on 2 October
+ * 2026, while the same break failed it locally, where output is plain.
+ */
+
+const miseToml = readFileSync(join(REPO_ROOT, 'mise.toml'), 'utf8')
+
+function taskRun(name) {
+  const start = miseToml.indexOf(`[tasks."${name}"]`)
+  expect(start, `${name} task`).toBeGreaterThan(-1)
+  const open = miseToml.indexOf('run = """', start)
+  const close = miseToml.indexOf('"""', open + 'run = """'.length)
+  return miseToml.slice(open, close)
+}
+
+const run = taskRun('wasm:wasi-check')
+
+describe('wasm:wasi-check dependency gate', () => {
+  it('asks cargo tree for uncoloured output', () => {
+    const calls = run.match(/^(?!\s*#).*cargo tree[^\n]*/gm) ?? []
+    expect(calls.length).toBeGreaterThan(0)
+    for (const call of calls) expect(call).toContain('--color never')
+  })
+
+  it('its patterns match a forbidden crate in a plain tree, and not in a coloured one', () => {
+    const patterns = [...run.matchAll(/grep -Eq '([^']+)'/g)].map(
+      ([, pattern]) => new RegExp(pattern, 'm'),
+    )
+    expect(patterns.length).toBe(2)
+    const plain = 'stack-kms v0.1.0\n├── wasm-bindgen v0.2.100\n'
+    const coloured =
+      'stack-kms v0.1.0\n\u001b[2m├── \u001b[0mwasm-bindgen v0.2.100\n'
+    expect(patterns[0].test(plain)).toBe(true)
+    // Documents why `--color never` is load-bearing.
+    expect(patterns[0].test(coloured)).toBe(false)
+  })
+})