v2026.7.5

This release makes config trust smarter across git worktrees and monorepos, and fixes npm-backed tools on npm 12.

## Added
- **Trust is shared across git worktrees.** Trust records are keyed by absolute path, so every new `git worktree add` checkout used to re-prompt for the same config. A config inside a linked worktree is now trusted automatically when the equivalent path in the repository's main checkout is trusted — trusting a repo once covers all of its worktrees. This is especially helpful for workflows that spin up many short-lived worktrees (e.g. AI-agent worktrees under `.claude/worktrees/`). Sharing flows one way, from main checkout to worktrees; an explicit `--ignore` still wins, and paranoid mode is excluded since its trust is tied to per-file content hashes. `mise untrust` inside a worktree now warns that the main checkout still trusts the config ([#10890](https://github.com/jdx/mise/pull/10890) by @jdx).
- **`mise trust --all` now trusts nested subdirectory configs.** Previously `--all` only trusted config files in the current directory and its parents. It now also walks subdirectories and trusts each nested config root it finds, so a monorepo's nested configs can be trusted with one explicit command. The walk respects `.gitignore`, skips hidden directories, and skips `node_modules`, `vendor`, `target`, `dist`, and `build` so vendored configs are left untrusted. Each nested config gets its own trust record, so a config added later in a new subdirectory still prompts ([#10889](https://github.com/jdx/mise/pull/10889) by @jdx).

## Fixed
- **npm: support npm 12 output.** npm 12 wraps `npm view --json` responses in a single-item array, which broke version listing and latest-version detection for npm-backed tools. mise now normalizes both the legacy object shape and the new wrapped shape, and tolerates missing `time` metadata ([#10888](https://github.com/jdx/mise/pull/10888) by @jdx).

## Changed
- **registry:** the `codex` shorthand now prefers `npm:@openai/codex` over the aqua GitHub asset. The aqua asset for recent releases shipped only the main `codex` binary and omitted `codex-code-mode-host`, which broke tool calling; the npm package installs the full vendor bundle. Aqua remains available as an explicit or fallback backend ([#10893](https://github.com/jdx/mise/pull/10893) by @jdx).

**Full Changelog**: https://github.com/jdx/mise/compare/v2026.7.4...v2026.7.5

## 💚 Sponsor mise

mise is maintained by [@jdx](https://github.com/jdx), an open source developer for [**entire.io**](https://entire.io), the title sponsor of the [jdx.dev](https://jdx.dev) open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at [jdx.dev](https://jdx.dev/sponsors.html). Individual and company sponsorships keep mise fast, free, and independent.