docs: minisign doesn't require cli

[risu729]

It's already native using https://crates.io/crates/minisign-verify.

[Copilot]

Pull Request Overview

Clarify that minisign verification is native (no CLI required), and refine GitHub attestation handling and registry merging.

• Add an enabled flag for GitHub attestations and adjust verification flow to honor it.
• Improve override merging for GitHub attestation config; update docs to remove CLI requirements for minisign and add related env var.
• Minor cleanup/removals (optional dependencies function, checksum algorithm list).

Reviewed Changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/backend/aqua.rs	Honor github_attestations.enabled and skip verification when disabled; stop opportunistic verification when not configured.
docs/tips-and-tricks.md	Document minisign as native and add MISE_AQUA_MINISIGN toggle.
docs/dev-tools/comparison-to-asdf.md	Update verification capabilities list to include Minisign without CLI.
docs/dev-tools/backends/aqua.md	Remove mention of minisign CLI; add checksums list; add a TODO comment in user docs.
crates/aqua-registry/src/types.rs	Add enabled to AquaGithubArtifactAttestations; change override merging to merge instead of replace; remove Blake3 variant; add merge impl.
SECURITY.md	Reflect native minisign verification and remove CLI tool requirements in docs.

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

Pull Request Overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}