fix(ci): harden CI image tool installation

[pimlock]

Summary

This hardens the CI image build so tool installation behaves deterministically and fails loudly when mise install breaks. It also removes the unused AWS CLI from the image.

Related Issue

N/A

Changes

• pin the mise installer version in deploy/docker/Dockerfile.ci
• run mise reshim so uv and other tool shims are always present in the CI image
• scope the || true to rustup component remove rust-docs so mise install failures fail the Docker build
• remove the unused AWS CLI installation from the CI image

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)
• docker buildx build --load -t openshell/ci:debug -f deploy/docker/Dockerfile.ci .
• docker run --rm -v \"/Users/pmlocek/dev/navigator:/repo\" -w /repo openshell/ci:debug sh -lc 'mise trust /repo >/dev/null && uv --version && command -v aws >/dev/null; test $? -ne 0'

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[pimlock]

It now installs correct version of Python: https://github.com/NVIDIA/OpenShell/actions/runs/23508215060/job/68421856043#step:5:217 (this was fixed in v2026.3.10: jdx/mise#8672).