jdx/mise v2026.3.16

v2026.3.16: Fix unnecessary GitHub API calls during locked installs

on GitHub

A small patch release that fixes mise install --locked making unnecessary GitHub Releases API calls even when the lockfile already contains pre-resolved URLs and checksums.

Fixed

• mise install --locked no longer makes unnecessary GitHub API calls -- The aqua backend's cosign verification path was unconditionally downloading checksum files via the GitHub Releases API, even when cosign was disabled in settings or the package had no cosign configuration. This caused mise install --locked to fail in restricted network environments despite the lockfile having everything needed to install offline. The fix checks settings.aqua.cosign and whether the package actually has cosign configured before attempting any download. #8753 by @jdx

Full Changelog: v2026.3.15...v2026.3.16