jdx/mise v2026.4.28 on GitHub

A small patch release: remote tasks pinned to a commit SHA no longer panic, and the Fedora COPR packaging pipeline picks up Dockerfile fixes again.

Fixed

(task) Remote tasks referenced by commit SHA (a git:: source with ?ref=<40-char hex>) no longer crash mise with we map by name only and have no object-id in refspec from gix (#9473) by @jdx. gix-refspec parses any 40- or 64-char hex string as an ObjectId refspec, but gix::clone::fetch::util::find_custom_refname only handles name-based matches and expect()s on the result, so passing a bare SHA to prepare_clone.with_ref_name() triggered a hard process panic on every cache miss. Git::clone now detects SHA-shaped refs via a looks_like_sha heuristic, skips both the with_ref_name() and git clone -b paths (neither accepts bare SHAs), drops --depth 1 since shallow clones may not contain the requested object, and checks out the SHA after the clone via the existing CLI-backed update. Named branches and tags continue to use the existing fast paths. Closes #9472.
(copr) The copr-publish workflow no longer pins a stale ghcr.io/jdx/mise:copr image digest, and docker.yml now rebuilds the :copr image whenever packaging/copr/Dockerfile changes on main (#9451) by @bestagi. Previously the workflow kept hitting ModuleNotFoundError: No module named 'rich' even after #9421 switched copr-cli to dnf install, because the hardcoded digest still pointed at the old pip-installed image.

Full Changelog: v2026.4.27...v2026.4.28