[FEATURE] Allow pinning Git refs in plugin marketplaces (ref for branch/tag/commit)

Preflight Checklist

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

We can add a plugin marketplace by repository or raw URL, but can’t pin a specific Git ref (branch, tag, or commit). As a result, installs aren’t reproducible—different machines runs may pull different revisions. This makes staged rollouts (staging vs. production) hard to control and audits/rollbacks risky. Today, /plugin marketplace add owner/repo always uses the repo’s default branch, and .claude/settings.json offers no way to lock versions. We may unknowingly install newer or older builds, creating drift and sometimes breaking work.

Proposed Solution

Add optional ref support to plugin marketplace sources (and settings), allowing branch / tag / commit SHA pinning:

{
  "plugins": [
    {
      "name": "statusline",
      "version": "1.2.3",
      "source": {
        "source": "github",
        "repo": "your-org/statusline-plugin",
        "ref": "v1.2.3"   // tag, branch, or full SHA
      },
    }
  ]
}

Alternative Solutions

_No response_

Priority

Medium - Would be very helpful

Feature Category

CLI commands and flags

Use Case Example

1. The github repo owner/repo uses develop as the default branch.
2. For production, I want installs to come from the stable main branch; for staging, I'm fine with develop.
3. Today, a marketplace installation /plugin marketplace add owner/repo implicitly resolves to the default branch (develop), so production machines may pull bleeding-edge changes.
4. With the proposed ref field: Claude Code resolves main/develop to commit SHAs, and install it.

Additional Context

_No response_