I just added a post-checkout hook for my team:

`mise trust`

Resolves that trust issue right away and is scoped to your repo (not global). We also have a make setup that helps the folks still doing make things get all setup and trusted on the main work tree.

At a past job we had a local `doctor` script that did this.