[FEATURE] Support dynamic `*release` ref for marketplace plugin sources

Preflight Checklist

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

Problem Statement

I hope to build a Claude Code plugin marketplace that:

1. Hosts the latest GitHub release version of each registered plugin, and
2. Does not require a lot of heavy-handed central management.

(1) is already possible with the "ref" field of a plugin in marketplace.json, but (2) is not currently seamless because all tags are fixed. For example, this marketplace entry pins to a specific tag:

{
  "name": "name",
  "source": {
    "source": "github",
    "repo": "owner/repo",
    "ref": "v0.0.1"
  }
}

When the plugin releases version v0.0.2, the marketplace maintainer must manually update ref to "v0.0.2". I would prefer the update to happen automatically when the plugin maintainer creates a new formal GitHub release of the plugin. (I would rather not use tags alone because they often point to unvalidated development milestones.)

Related Issues

• #23551 — Branch specification syntax for marketplace sources (related: better ref handling)
• #21995 — Plugin update doesn't fetch new version without marketplace update (related: version tracking friction)

Proposed Solution

Proposed Solution

Support a special ref keyword (e.g., "*release") that dynamically resolves to the latest GitHub release tag at install/update time:

{
  "name": "name",
  "source": {
    "source": "github",
    "repo": "owner/repo",
    "ref": "*release"
  }
}

This would use the GitHub Releases API (or equivalent git ls-remote tag resolution) to resolve the latest release tag when the plugin is installed or updated.

Prior Art

This pattern is well-established in the management of R packages:

• pak (R package manager): Supports owner/repo@*release syntax to install from the latest GitHub release rather than the default branch. See https://pak.r-lib.org/reference/pkg_refs.html
• R-universe: Uses the same *release convention for building packages from release tags.

Both ecosystems adopted this because maintainers found it impractical to keep version refs synchronized across separate registry/catalog files.

To be clear, I'm not wedded to the specific choice of the keyword "*release" by any means. It's just the functionality I'm interested in.

Alternative Solutions

I have considered writing a GitHub Actions workflow to scan the registered plugins and update the "ref" fields on marketplace.json automatically, but that feels like more work than it should be, and it scales linearly with the number of registered plugins.

Priority

High - Significant impact on productivity

Feature Category

CLI commands and flags

Use Case Example

_No response_

Additional Context

_No response_