v2026.3.16

A small patch release that fixes `mise install --locked` making unnecessary GitHub Releases API calls even when the lockfile already contains pre-resolved URLs and checksums.

## Fixed

- **`mise install --locked` no longer makes unnecessary GitHub API calls** -- The aqua backend's cosign verification path was unconditionally downloading checksum files via the GitHub Releases API, even when cosign was disabled in settings or the package had no cosign configuration. This caused `mise install --locked` to fail in restricted network environments despite the lockfile having everything needed to install offline. The fix checks `settings.aqua.cosign` and whether the package actually has cosign configured before attempting any download. [#8753](https://github.com/jdx/mise/pull/8753) by @jdx

**Full Changelog**: https://github.com/jdx/mise/compare/v2026.3.15...v2026.3.16