Fix(CI): Ensure correct branch SHA1 is fetched in manual release workflow

[ErikJiang]

What type of PR is this?

/kind bug

What this PR does / why we need it:

The git ls-remote command in the manual kubespray release workflow was not specific enough and could retrieve the SHA1 from an incorrect branch if another branch name contained the target branch name as a substring.

For example, when targeting the release-2.28 branch, the old command might incorrectly match component_hash_update/release-2.28:

$ git ls-remote -h https://github.com/kubernetes-sigs/kubespray.git release-2.28
c13134b88117bc35d05b77c26e1cc5f80aea5624	refs/heads/component_hash_update/release-2.28
2d0cc2b4ea1a5f578300536d711d10c626c390bb	refs/heads/release-2.28

This PR fixes the issue by specifying the full ref path refs/heads/, which ensures the command always resolves to the exact branch head, preventing ambiguity.

$ git ls-remote -h https://github.com/kubernetes-sigs/kubespray.git refs/heads/release-2.28
2d0cc2b4ea1a5f578300536d711d10c626c390bb	refs/heads/release-2.28

Which issue(s) this PR fixes:

Fixes #1589

Special notes for your reviewer: