Buildkite allocates a PTY for each job so tools emit colors. hk's
spinner and mise's -v DEBUG stream both detect the TTY and flood the
log — we counted 28,432 rows on build #4's `linux / test` step, most
of them progress frames captured as newline-separated lines after
Buildkite strips the cursor-control escapes.

- mise.toml: pipe `hk check`/`hk fix` through `cat`, which breaks the
  PTY on both stdout and stderr and forces hk into its non-interactive
  path. ~10k spinner-frame rows per run go away.
- .buildkite/bootstrap.sh: drop `-v` from `mise install`. `--locked`
  stays, INFO-level output stays; the ~15k DEBUG rows from the initial
  bootstrap go away.

No wall-clock change — this is purely log hygiene so failures are
findable and the Buildkite UI loads quickly.

Most CI runners (Buildkite, GitHub Actions, …) allocate a PTY for the
job so tools emit colors, which makes std::io::stderr().is_terminal()
return true. Their log capturers then strip cursor-control escapes and
each animation frame lands as its own log line, flooding the build log
with thousands of near-duplicate spinner rows.

Add is_ci = "1" and prefer CI mode whenever is_ci::cached() says we're
in a known CI environment, even on a TTY. is_ci checks CI,
CONTINUOUS_INTEGRATION, BUILDKITE, GITHUB_ACTIONS, and friends — so
aube now automatically switches to its 2s-heartbeat output there
without callers needing to set any env var or pipe through cat.

Also relocate the hk `| cat` workaround from mise.toml into
.buildkite/pipeline.sh so local `mise run lint` / `mise run lint-fix`
keep their animated UI. hk doesn't do this CI detection itself yet,
so the pipeline-layer pipe remains necessary for it; aube no longer
needs it because is_ci handles it natively.

…ures

Caught by cursor bugbot on PR #5: `mise run lint 2>&1 | cat` returns
cat's exit code (always 0), so a failing hk check would look green
in CI.

bootstrap.sh sets `set -euo pipefail`, but Buildkite runs each entry
in a \`commands:\` list in its own shell invocation — only environment
variables carry forward, not shell options. So pipefail inherited by
the source call in the first command doesn't apply to the lint
command two steps later.

Prepend `set -o pipefail;` to the single piped command instead. The
option now applies to exactly the shell running the pipe, independent
of what came before. Verified locally that `bash -c 'false' 2>&1 | cat`
exits 0 without pipefail and 1 with it.