v2026.4.28

A small patch release: remote tasks pinned to a commit SHA no longer panic, and the Fedora COPR packaging pipeline picks up Dockerfile fixes again.

## Fixed

- **(task)** Remote tasks referenced by commit SHA (a `git::` source with `?ref=<40-char hex>`) no longer crash mise with `we map by name only and have no object-id in refspec` from `gix` ([#9473](https://github.com/jdx/mise/pull/9473)) by @jdx. `gix-refspec` parses any 40- or 64-char hex string as an `ObjectId` refspec, but `gix::clone::fetch::util::find_custom_refname` only handles name-based matches and `expect()`s on the result, so passing a bare SHA to `prepare_clone.with_ref_name()` triggered a hard process panic on every cache miss. `Git::clone` now detects SHA-shaped refs via a `looks_like_sha` heuristic, skips both the `with_ref_name()` and `git clone -b` paths (neither accepts bare SHAs), drops `--depth 1` since shallow clones may not contain the requested object, and checks out the SHA after the clone via the existing CLI-backed update. Named branches and tags continue to use the existing fast paths. Closes [#9472](https://github.com/jdx/mise/discussions/9472).

- **(copr)** The `copr-publish` workflow no longer pins a stale `ghcr.io/jdx/mise:copr` image digest, and `docker.yml` now rebuilds the `:copr` image whenever `packaging/copr/Dockerfile` changes on `main` ([#9451](https://github.com/jdx/mise/pull/9451)) by @bestagi. Previously the workflow kept hitting `ModuleNotFoundError: No module named 'rich'` even after [#9421](https://github.com/jdx/mise/pull/9421) switched `copr-cli` to `dnf install`, because the hardcoded digest still pointed at the old pip-installed image.

## New Contributors

* @bestagi made their first contribution in [#9451](https://github.com/jdx/mise/pull/9451)

**Full Changelog**: https://github.com/jdx/mise/compare/v2026.4.27...v2026.4.28