Add portable aqua and mise tool declarations

## Parent

Parent: #1

## What to build

Add the first portable tool declarations so Adam can keep using the core tool layer while the rest of the portable user environment is being built.

This slice should hand-pick narrow aqua and mise configuration for the portable user environment. Aqua should own pinned standalone CLI binaries; mise should own language runtimes, ecosystem-scoped tools, and project-local environment behavior. Do not import broad existing config trees and do not introduce broad Homebrew, apt, Linuxbrew, or Nix ownership.

Because this slice intentionally comes before the final shell entrypoint work, validation should not depend on the future managed shell contract. Use explicit config/path invocation where needed, and leave any deeper profile gating to later host-profile work unless a tool is clearly unsafe for one supported host.

## Acceptance criteria

- [ ] The repo contains hand-picked managed aqua configuration for standalone portable CLIs, including the core tools needed to continue development of the dotfiles environment.
- [ ] The repo contains hand-picked managed mise configuration for runtimes and ecosystem-scoped tools, preserving the existing runtime needs where appropriate.
- [ ] The aqua-vs-mise ownership boundary is documented in the managed config or adjacent operator notes.
- [ ] The change does not import all of `~/.config`, does not manage broad package-manager state, and does not add Nix/Linuxbrew-by-default behavior.
- [ ] Versions are pinned deliberately where reproducibility matters, with checksum verification either configured if ready or explicitly deferred until the package list stabilizes.
- [ ] The tool configs can be rendered/reviewed with chezmoi and validated without relying on the future shell entrypoint contract.
- [ ] `aqua install -a` and `mise install` are documented or validated against the managed configs.
- [ ] No managed file contains plaintext secrets, service-account tokens, private keys, or resolved 1Password values.

## Blocked by

None - can start immediately