diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 86d01f33b5..b093249d56 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -10,7 +10,7 @@ on:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name != 'push' }}
 
 env:
   CARGO_TERM_COLOR: always
diff --git a/mise.lock b/mise.lock
index 79918f999d..f59cc0eb6e 100644
--- a/mise.lock
+++ b/mise.lock
@@ -10,6 +10,7 @@ url = "https://github.com/rhysd/actionlint/releases/download/v1.7.9/actionlint_1
 [tools.actionlint.platforms.linux-x64]
 checksum = "sha256:233b280d05e100837f4af1433c7b40a5dcb306e3aa68fb4f17f8a7f45a7df7b4"
 name = "actionlint_1.7.9_linux_amd64.tar.gz"
+size = 2237057
 url = "https://github.com/rhysd/actionlint/releases/download/v1.7.9/actionlint_1.7.9_linux_amd64.tar.gz"
 
 [tools.actionlint.platforms.macos-arm64]
@@ -36,7 +37,9 @@ name = "age-v1.2.1-linux-arm64.tar.gz"
 url = "https://github.com/FiloSottile/age/releases/download/v1.2.1/age-v1.2.1-linux-arm64.tar.gz"
 
 [tools.age.platforms.linux-x64]
+checksum = "blake3:8441277927f75428a6d22897a5cc05e8cdc03562d7a203b2bb9a7c6cd1d0c3bd"
 name = "age-v1.2.1-linux-amd64.tar.gz"
+size = 5194720
 url = "https://github.com/FiloSottile/age/releases/download/v1.2.1/age-v1.2.1-linux-amd64.tar.gz"
 
 [tools.age.platforms.macos-arm64]
@@ -51,35 +54,6 @@ url = "https://github.com/FiloSottile/age/releases/download/v1.2.1/age-v1.2.1-da
 name = "age-v1.2.1-windows-amd64.zip"
 url = "https://github.com/FiloSottile/age/releases/download/v1.2.1/age-v1.2.1-windows-amd64.zip"
 
-[[tools."aqua:jqlang/jq"]]
-version = "1.7.1"
-backend = "aqua:jqlang/jq"
-
-[tools."aqua:jqlang/jq".platforms.linux-arm64]
-checksum = "sha256:4dd2d8a0661df0b22f1bb9a1f9830f06b6f3b8f7d91211a1ef5d7c4f06a8b4a5"
-name = "jq-linux-arm64"
-url = "https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-linux-arm64"
-
-[tools."aqua:jqlang/jq".platforms.linux-x64]
-checksum = "sha256:5942c9b0934e510ee61eb3e30273f1b3fe2590df93933a93d7c58b81d19c8ff5"
-name = "jq-linux-amd64"
-url = "https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-linux-amd64"
-
-[tools."aqua:jqlang/jq".platforms.macos-arm64]
-checksum = "sha256:0bbe619e663e0de2c550be2fe0d240d076799d6f8a652b70fa04aea8a8362e8a"
-name = "jq-macos-arm64"
-url = "https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-macos-arm64"
-
-[tools."aqua:jqlang/jq".platforms.macos-x64]
-checksum = "sha256:4155822bbf5ea90f5c79cf254665975eb4274d426d0709770c21774de5407443"
-name = "jq-macos-amd64"
-url = "https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-macos-amd64"
-
-[tools."aqua:jqlang/jq".platforms.windows-x64]
-checksum = "sha256:7451fbbf37feffb9bf262bd97c54f0da558c63f0748e64152dd87b0a07b6d6ab"
-name = "jq-windows-amd64.exe"
-url = "https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-windows-amd64.exe"
-
 [[tools.bun]]
 version = "1.3.3"
 backend = "core:bun"
@@ -88,6 +62,8 @@ backend = "core:bun"
 url = "https://github.com/oven-sh/bun/releases/download/bun-v1.3.3/bun-linux-aarch64.zip"
 
 [tools.bun.platforms.linux-x64]
+checksum = "blake3:21d78fbc47b9175cc18a79bc228c6b3aa92d102c3f9c006934101c6b588cc900"
+size = 39185481
 url = "https://github.com/oven-sh/bun/releases/download/bun-v1.3.3/bun-linux-x64.zip"
 
 [tools.bun.platforms.macos-arm64]
@@ -111,6 +87,7 @@ url = "https://github.com/cargo-bins/cargo-binstall/releases/download/v1.16.2/ca
 [tools.cargo-binstall.platforms.linux-x64]
 checksum = "sha256:3be2695803f7b9a86b9976f2bdb8568ed6e8df026bacfc39c8546d3c6ea34808"
 name = "cargo-binstall-x86_64-unknown-linux-musl.tgz"
+size = 6779867
 url = "https://github.com/cargo-bins/cargo-binstall/releases/download/v1.16.2/cargo-binstall-x86_64-unknown-linux-musl.tgz"
 
 [tools.cargo-binstall.platforms.macos-arm64]
@@ -164,6 +141,7 @@ url = "https://github.com/cli/cli/releases/download/v2.83.1/gh_2.83.1_linux_arm6
 [tools.gh.platforms.linux-x64]
 checksum = "sha256:1c5252d4ce3db07b51c01ff0b909583da6364ff3fdc06d0c2e75e62dc0380a34"
 name = "gh_2.83.1_linux_amd64.tar.gz"
+size = 18174787
 url = "https://github.com/cli/cli/releases/download/v2.83.1/gh_2.83.1_linux_amd64.tar.gz"
 
 [tools.gh.platforms.macos-arm64]
@@ -193,6 +171,7 @@ url = "https://github.com/jdx/hk/releases/download/v1.25.0/hk-aarch64-unknown-li
 [tools.hk.platforms.linux-x64]
 checksum = "sha256:7021d44c38e34ca2ee46f3536f906de59e5e89d67439d3400e1bd707235ebb4f"
 name = "hk-x86_64-unknown-linux-gnu.tar.gz"
+size = 7281217
 url = "https://github.com/jdx/hk/releases/download/v1.25.0/hk-x86_64-unknown-linux-gnu.tar.gz"
 
 [tools.hk.platforms.macos-arm64]
@@ -217,6 +196,7 @@ url = "https://github.com/jqlang/jq/releases/download/jq-1.8.1/jq-linux-arm64"
 [tools.jq.platforms.linux-x64]
 checksum = "sha256:020468de7539ce70ef1bceaf7cde2e8c4f2ca6c3afb84642aabc5c97d9fc2a0d"
 name = "jq-linux-amd64"
+size = 2255816
 url = "https://github.com/jqlang/jq/releases/download/jq-1.8.1/jq-linux-amd64"
 
 [tools.jq.platforms.macos-arm64]
@@ -242,6 +222,8 @@ backend = "core:node"
 url = "https://nodejs.org/dist/v24.11.1/node-v24.11.1-linux-arm64.tar.gz"
 
 [tools.node.platforms.linux-x64]
+checksum = "sha256:58a5ff5cc8f2200e458bea22e329d5c1994aa1b111d499ca46ec2411d58239ca"
+size = 56272770
 url = "https://nodejs.org/dist/v24.11.1/node-v24.11.1-linux-x64.tar.gz"
 
 [tools.node.platforms.macos-arm64]
@@ -253,82 +235,6 @@ url = "https://nodejs.org/dist/v24.11.1/node-v24.11.1-darwin-x64.tar.gz"
 [tools.node.platforms.windows-x64]
 url = "https://nodejs.org/dist/v24.11.1/node-v24.11.1-win-x64.zip"
 
-[[tools.node]]
-version = "24.6.0"
-backend = "core:node"
-
-[tools.node.platforms.linux-arm64]
-url = "https://nodejs.org/dist/v24.6.0/node-v24.6.0-linux-arm64.tar.gz"
-
-[tools.node.platforms.linux-x64]
-url = "https://nodejs.org/dist/v24.6.0/node-v24.6.0-linux-x64.tar.gz"
-
-[tools.node.platforms.macos-arm64]
-url = "https://nodejs.org/dist/v24.6.0/node-v24.6.0-darwin-arm64.tar.gz"
-
-[tools.node.platforms.macos-x64]
-url = "https://nodejs.org/dist/v24.6.0/node-v24.6.0-darwin-x64.tar.gz"
-
-[tools.node.platforms.windows-x64]
-url = "https://nodejs.org/dist/v24.6.0/node-v24.6.0-win-x64.zip"
-
-[[tools.node]]
-version = "24.9.0"
-backend = "core:node"
-
-[tools.node.platforms.linux-arm64]
-url = "https://nodejs.org/dist/v24.9.0/node-v24.9.0-linux-arm64.tar.gz"
-
-[tools.node.platforms.linux-x64]
-url = "https://nodejs.org/dist/v24.9.0/node-v24.9.0-linux-x64.tar.gz"
-
-[tools.node.platforms.macos-arm64]
-url = "https://nodejs.org/dist/v24.9.0/node-v24.9.0-darwin-arm64.tar.gz"
-
-[tools.node.platforms.macos-x64]
-url = "https://nodejs.org/dist/v24.9.0/node-v24.9.0-darwin-x64.tar.gz"
-
-[tools.node.platforms.windows-x64]
-url = "https://nodejs.org/dist/v24.9.0/node-v24.9.0-win-x64.zip"
-
-[[tools.node]]
-version = "24.10.0"
-backend = "core:node"
-
-[tools.node.platforms.linux-arm64]
-url = "https://nodejs.org/dist/v24.10.0/node-v24.10.0-linux-arm64.tar.gz"
-
-[tools.node.platforms.linux-x64]
-url = "https://nodejs.org/dist/v24.10.0/node-v24.10.0-linux-x64.tar.gz"
-
-[tools.node.platforms.macos-arm64]
-url = "https://nodejs.org/dist/v24.10.0/node-v24.10.0-darwin-arm64.tar.gz"
-
-[tools.node.platforms.macos-x64]
-url = "https://nodejs.org/dist/v24.10.0/node-v24.10.0-darwin-x64.tar.gz"
-
-[tools.node.platforms.windows-x64]
-url = "https://nodejs.org/dist/v24.10.0/node-v24.10.0-win-x64.zip"
-
-[[tools.node]]
-version = "24.11.0"
-backend = "core:node"
-
-[tools.node.platforms.linux-arm64]
-url = "https://nodejs.org/dist/v24.11.0/node-v24.11.0-linux-arm64.tar.gz"
-
-[tools.node.platforms.linux-x64]
-url = "https://nodejs.org/dist/v24.11.0/node-v24.11.0-linux-x64.tar.gz"
-
-[tools.node.platforms.macos-arm64]
-url = "https://nodejs.org/dist/v24.11.0/node-v24.11.0-darwin-arm64.tar.gz"
-
-[tools.node.platforms.macos-x64]
-url = "https://nodejs.org/dist/v24.11.0/node-v24.11.0-darwin-x64.tar.gz"
-
-[tools.node.platforms.windows-x64]
-url = "https://nodejs.org/dist/v24.11.0/node-v24.11.0-win-x64.zip"
-
 [[tools."npm:ajv-cli"]]
 version = "5.0.0"
 backend = "npm:ajv-cli"
@@ -341,35 +247,6 @@ backend = "npm:markdownlint-cli"
 version = "3.7.1"
 backend = "npm:prettier"
 
-[[tools.opentofu]]
-version = "1.10.7"
-backend = "aqua:opentofu/opentofu"
-
-[tools.opentofu.platforms.linux-arm64]
-checksum = "sha256:cfde76d660cbaa7b7b1ad1dab02fe99085f2fc7a2d2e7f9fd2ff4167358d52c0"
-name = "tofu_1.10.7_linux_arm64.tar.gz"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.10.7/tofu_1.10.7_linux_arm64.tar.gz"
-
-[tools.opentofu.platforms.linux-x64]
-checksum = "sha256:765a7374aeafcad15fe8da5359de76ce11ba0fd3cb6c2dc85d3b390e6362cae5"
-name = "tofu_1.10.7_linux_amd64.tar.gz"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.10.7/tofu_1.10.7_linux_amd64.tar.gz"
-
-[tools.opentofu.platforms.macos-arm64]
-checksum = "sha256:e5cdc6d0bdd85b0cf699f00e2cd547c3b3d0892c7b5ecb22bd02c72d9d1ff8bc"
-name = "tofu_1.10.7_darwin_arm64.tar.gz"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.10.7/tofu_1.10.7_darwin_arm64.tar.gz"
-
-[tools.opentofu.platforms.macos-x64]
-checksum = "sha256:ec063e3920fab7cc80299f66d2fda3ec752f774b88caf3c207122336674843a3"
-name = "tofu_1.10.7_darwin_amd64.tar.gz"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.10.7/tofu_1.10.7_darwin_amd64.tar.gz"
-
-[tools.opentofu.platforms.windows-x64]
-checksum = "sha256:58e9f247c57c7c1faef3b20fd735dcad272154e93bd02246eeff36cb756b03df"
-name = "tofu_1.10.7_windows_amd64.tar.gz"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.10.7/tofu_1.10.7_windows_amd64.tar.gz"
-
 [[tools.pkl]]
 version = "0.30.0"
 backend = "aqua:apple/pkl"
@@ -382,6 +259,7 @@ url = "https://github.com/apple/pkl/releases/download/0.30.0/pkl-linux-aarch64"
 [tools.pkl.platforms.linux-x64]
 checksum = "sha256:182a50a2c84bb002010ea45c8982c1e63b54e7e6a40e939bb5eb70beaad38cd7"
 name = "pkl-linux-amd64"
+size = 99355968
 url = "https://github.com/apple/pkl/releases/download/0.30.0/pkl-linux-amd64"
 
 [tools.pkl.platforms.macos-arm64]
@@ -411,6 +289,7 @@ url = "https://github.com/pre-commit/pre-commit/releases/download/v4.5.0/pre-com
 [tools.pre-commit.platforms.linux-x64]
 checksum = "sha256:fbbfa47d19b98e03eb11963094ac3644a97cba105a8c660d8dab4c409c89cebe"
 name = "pre-commit-4.5.0.pyz"
+size = 8263423
 url = "https://github.com/pre-commit/pre-commit/releases/download/v4.5.0/pre-commit-4.5.0.pyz"
 
 [tools.pre-commit.platforms.macos-arm64]
@@ -440,6 +319,7 @@ url = "https://github.com/BurntSushi/ripgrep/releases/download/15.1.0/ripgrep-15
 [tools.ripgrep.platforms.linux-x64]
 checksum = "sha256:1c9297be4a084eea7ecaedf93eb03d058d6faae29bbc57ecdaf5063921491599"
 name = "ripgrep-15.1.0-x86_64-unknown-linux-musl.tar.gz"
+size = 2263077
 url = "https://github.com/BurntSushi/ripgrep/releases/download/15.1.0/ripgrep-15.1.0-x86_64-unknown-linux-musl.tar.gz"
 
 [tools.ripgrep.platforms.macos-arm64]
@@ -478,6 +358,7 @@ url = "https://github.com/mvdan/sh/releases/download/v3.12.0/shfmt_v3.12.0_linux
 [tools.shfmt.platforms.linux-x64]
 checksum = "sha256:d9fbb2a9c33d13f47e7618cf362a914d029d02a6df124064fff04fd688a745ea"
 name = "shfmt_v3.12.0_linux_amd64"
+size = 2916536
 url = "https://github.com/mvdan/sh/releases/download/v3.12.0/shfmt_v3.12.0_linux_amd64"
 
 [tools.shfmt.platforms.macos-arm64]
@@ -507,6 +388,7 @@ url = "https://github.com/getsops/sops/releases/download/v3.11.0/sops-v3.11.0.li
 [tools.sops.platforms.linux-x64]
 checksum = "sha256:775f1384d55decfad228e7196a3f683791914f92a473f78fc47700531c29dfef"
 name = "sops-v3.11.0.linux.amd64"
+size = 46346424
 url = "https://github.com/getsops/sops/releases/download/v3.11.0/sops-v3.11.0.linux.amd64"
 
 [tools.sops.platforms.macos-arm64]
@@ -533,7 +415,9 @@ name = "taplo-linux-aarch64.gz"
 url = "https://github.com/tamasfe/taplo/releases/download/0.10.0/taplo-linux-aarch64.gz"
 
 [tools.taplo.platforms.linux-x64]
+checksum = "blake3:4871fab0e60275a1eb46e7190726e144f56c9a9527f59b0d1da5a042baead8e2"
 name = "taplo-linux-x86_64.gz"
+size = 5116068
 url = "https://github.com/tamasfe/taplo/releases/download/0.10.0/taplo-linux-x86_64.gz"
 
 [tools.taplo.platforms.macos-arm64]
@@ -548,35 +432,6 @@ url = "https://github.com/tamasfe/taplo/releases/download/0.10.0/taplo-darwin-x8
 name = "taplo-windows-x86_64.zip"
 url = "https://github.com/tamasfe/taplo/releases/download/0.10.0/taplo-windows-x86_64.zip"
 
-[[tools.terraform]]
-version = "1.14.0"
-backend = "aqua:hashicorp/terraform"
-
-[tools.terraform.platforms.linux-arm64]
-checksum = "sha256:23d5e9b3f4014f18f85e242a5a8bbaf6d31b058a31d93580e5fe5da644bf8013"
-name = "terraform_1.14.0_linux_arm64.zip"
-url = "https://releases.hashicorp.com/terraform/1.14.0/terraform_1.14.0_linux_arm64.zip"
-
-[tools.terraform.platforms.linux-x64]
-checksum = "sha256:33ac217458ba8b44ce2813553083bc132c9a07e41a79c2e3627977682d283093"
-name = "terraform_1.14.0_linux_amd64.zip"
-url = "https://releases.hashicorp.com/terraform/1.14.0/terraform_1.14.0_linux_amd64.zip"
-
-[tools.terraform.platforms.macos-arm64]
-checksum = "sha256:57fde1cc2534a7e8c48aaae2ad2954084502852c25d731fc957e4b831f75e16e"
-name = "terraform_1.14.0_darwin_arm64.zip"
-url = "https://releases.hashicorp.com/terraform/1.14.0/terraform_1.14.0_darwin_arm64.zip"
-
-[tools.terraform.platforms.macos-x64]
-checksum = "sha256:bcb92ac63ab038ed633fe99a86553a9f4595d078dd607ad0b0145d7e65d153d1"
-name = "terraform_1.14.0_darwin_amd64.zip"
-url = "https://releases.hashicorp.com/terraform/1.14.0/terraform_1.14.0_darwin_amd64.zip"
-
-[tools.terraform.platforms.windows-x64]
-checksum = "sha256:6fb3806d0bb4682d8226997b24a1cfdfdc864113013342fcb22f681cdaaea4b2"
-name = "terraform_1.14.0_windows_amd64.zip"
-url = "https://releases.hashicorp.com/terraform/1.14.0/terraform_1.14.0_windows_amd64.zip"
-
 [[tools.wait-for-gh-rate-limit]]
 version = "1.0.0"
 backend = "ubi:jdx/wait-for-gh-rate-limit"
@@ -586,32 +441,3 @@ checksum = "blake3:2123971d2eea236d17fb0475c94bef89adf9239df4a8da53261d2eaf8551c
 
 [tools.wait-for-gh-rate-limit.platforms.macos-arm64-wait-for-gh-rate-limit]
 checksum = "blake3:8feb249767c436b69fd9bcb56901fdc56713c09247e9f6c1ce67f55b613bc082"
-
-[[tools.watchexec]]
-version = "2.3.2"
-backend = "aqua:watchexec/watchexec"
-
-[tools.watchexec.platforms.linux-arm64]
-checksum = "sha512:ddbd811740b3ce144b5c7cef1ef817bd497631466c4df48aafd473ec24b10ff85d8f31c2d4a4825ac10165bfa529df806ee3f53519493ae9c62fcbe44a316bfc"
-name = "watchexec-2.3.2-aarch64-unknown-linux-gnu.tar.xz"
-url = "https://github.com/watchexec/watchexec/releases/download/v2.3.2/watchexec-2.3.2-aarch64-unknown-linux-gnu.tar.xz"
-
-[tools.watchexec.platforms.linux-x64]
-checksum = "sha512:ec2dadefbbfad9ba738a6f27ead78214e90db4d5bbf7eb2f4d8dac3cf18f468f900fe51d4ba107b3f2c0733c412c28e8c977f158968515c8b7f03f3c8391982a"
-name = "watchexec-2.3.2-x86_64-unknown-linux-gnu.tar.xz"
-url = "https://github.com/watchexec/watchexec/releases/download/v2.3.2/watchexec-2.3.2-x86_64-unknown-linux-gnu.tar.xz"
-
-[tools.watchexec.platforms.macos-arm64]
-checksum = "sha512:88ea43af48597f7dbfceb1783e131d53aabe920c2b253a1538cc4efeee686f01c1282821ddca5dd56cb490fc7105e4e1be2d55e523f873a980b9a19ea157d523"
-name = "watchexec-2.3.2-aarch64-apple-darwin.tar.xz"
-url = "https://github.com/watchexec/watchexec/releases/download/v2.3.2/watchexec-2.3.2-aarch64-apple-darwin.tar.xz"
-
-[tools.watchexec.platforms.macos-x64]
-checksum = "sha512:80899b26b9a8cf0fd751368d38ba33e79e2fddddf0208e73ddc207f5a199466667113a62d495359e366b0ae90e3e7733cb238ad0450d5ac4653f281cb377b21d"
-name = "watchexec-2.3.2-x86_64-apple-darwin.tar.xz"
-url = "https://github.com/watchexec/watchexec/releases/download/v2.3.2/watchexec-2.3.2-x86_64-apple-darwin.tar.xz"
-
-[tools.watchexec.platforms.windows-x64]
-checksum = "sha512:427b96192a49614ef4a70c298ad3f0ba601578f35352823cbeb62519823fcd40b4734d6651163c6cf9b34e481fbb53305ceb20795dc27b4062c51340a5c79351"
-name = "watchexec-2.3.2-x86_64-pc-windows-msvc.zip"
-url = "https://github.com/watchexec/watchexec/releases/download/v2.3.2/watchexec-2.3.2-x86_64-pc-windows-msvc.zip"