docs(readme): document mise install path

[arcaven]

Summary

Adds a short "Install with mise" section to the Install part of the README,
documenting mise use github:<owner>/jira-cli@latest as an alternative to
the curl-piped one-liner. Owner-agnostic — the same snippet works for this
repository and any fork that publishes its own signed releases.

Why

• mise use github:<owner>/jira-cli works today with zero additional
  publisher work: mise's github: backend auto-picks the correct tarball
  from the release asset set and extracts the jr binary onto PATH.
  Smoke-tested end-to-end on macOS arm64 against v0.5.0
  (jr-v0.5.0-aarch64-apple-darwin.tar.gz → jr 0.5.0).
• Adds a lock-file-tracked, per-project pinning path alongside the
  one-liner installer. Users on the mise/asdf/pyenv side of the ecosystem
  get a familiar install without needing a Homebrew tap.
• Documents the prerelease = true opt-in for tracking -dev.*/-beta.*/
  -rc.* releases cut from develop, matching the existing gitflow
  channels.
• Preserves the macOS post-install ergonomics: adds one troubleshooting
  line for xattr -d com.apple.quarantine (needed only when a
  quarantine-aware host process propagates the attribute — mise itself
  does not set it, mirroring Homebrew bottles).

What this is not

• Not a mise-registry shorthand submission (that's a separate upstream PR
  to jdx/mise and is out of scope here).
• Not an aqua-registry submission.
• Not a change to any workflow, asset, or build.
• README-only. No Cargo.toml, src/, or CI touched.

Fork-transparency

The snippet uses <owner> as a placeholder with an explanatory sentence,
so the block is correct whether a reader is looking at this repository
or at a downstream fork's checkout. No hardcoded owner in the mise text
(unchanged elsewhere: the existing curl one-liner, badges, and
"Coming soon" tap URLs still reference the canonical owner as they did
before).

Test plan

• mise install under a mise.toml pinning github:Zious11/jira-cli = "0.5.0" — resolves the darwin arm64 tarball, extracts jr, jr --version reports jr 0.5.0.
• Same block with prerelease = true resolves against the latest
  v*-dev.* tag (currently v0.6.0-dev.7).

[Zious11]

Thanks @arcaven — this is a genuinely useful addition and the section slots in exactly the right place. The mise mechanics you describe check out (we verified the github: backend behavior, prerelease = true, and the native attestation verification against mise's docs). Two accuracy items need a copy edit before merge, plus a few smaller suggestions.

Required

1. The attestation sentence conflates mise-side support with repo-side publishing.
mise's native verification is already shipped — what's pending is this repo publishing attestations (that's #574, not yet merged). Also, automatic verification for a plain github: install covers GitHub Artifact Attestations; "SLSA provenance" overstates what runs by default. As written, readers may think a chain-of-trust story exists today. Suggested rewrite:

mise's `github:` backend auto-selects the release asset matching your OS
and architecture and extracts the `jr` binary. Once releases ship GitHub
Artifact Attestations (planned — see #574), mise verifies them natively
without invoking `gh` or `slsa-verifier`.

(Alternatively: drop the paragraph for now and re-add it when #574 lands.)

2. Make the canonical example runnable.
The rest of the Install section uses concrete strings (Zious11/jira-cli in the curl one-liner, git clone, tap). A literal <owner> in the fenced block means copy-paste fails and the reader has to backtrack. Suggested:

mise use github:Zious11/jira-cli@latest

with a single follow-up sentence: "Replace Zious11 with a fork's owner if you install from a downstream distribution." (Same for the mise.toml snippet.)

Recommended

3. The prerelease glob lists v*-beta.* / v*-rc.*, but this repo has only ever cut -dev.* prereleases. Suggest narrowing to v*-dev.* (or hedge with "if cut").

4. Windows gotcha worth one line: the current stable (v0.5.0) shipped without a Windows asset, so Windows users need prerelease = true until v0.6.0 stable — otherwise @latest resolves to a release with no matching asset.

5. "extracts the jr binary onto your PATH" assumes mise activate is set up — a "(assumes mise activate in your shell profile)" parenthetical or a link to mise's Getting Started would prevent "installed but jr not found" reports.

Optional

6. xattr -d com.apple.quarantine "$(mise which jr)" — in the exact failure mode this addresses, mise which jr may print nothing (mise not yet active in that shell) and the command errors confusingly. Consider showing the raw install path form as a fallback.

Happy to merge once 1–2 are addressed. Appreciate the fork-transparency framing and the tested claims — the smoke-test detail in the description made this easy to review.

[arcaven]

Thanks for the careful read — pushed 046ee4f addressing all six.

Required

1. Attestation sentence. Rewrote it so mise-side (ships today) and repo-side (pending) are distinct: "Once releases ship GitHub Artifact Attestations (planned — see ci(release): attest build provenance for release artifacts #574), mise verifies them natively without invoking gh or slsa-verifier." Dropped the "SLSA provenance by default" framing and linked ci(release): attest build provenance for release artifacts #574 as the gate.
2. Runnable examples. Both the mise use line and the mise.toml block now use Zious11/jira-cli, with a single follow-up sentence: replace Zious11 with a fork's owner for a downstream distribution.

Recommended

3. Narrowed the prerelease glob to v*-dev.* (the only channel this repo cuts).
4. Added the Windows caveat — v0.5.0 shipped without a Windows asset, so plain @latest resolves to a release with no matching download; Windows users need prerelease = true until a Windows binary lands on a stable tag (noted as planned for v0.6.0).
5. Noted mise activate is assumed for jr to land on PATH, linked to mise's Getting Started.

Optional

6. Gave an activation-free fallback for the exact failure mode: when mise isn't active in the shell mise which jr prints nothing, so the block also shows xattr -d com.apple.quarantine "$(mise where 'github:Zious11/jira-cli')/jr" (mise where resolves the install dir without activation).