Plugin update records stale gitCommitSha in installed_plugins.json

Summary

When updating a plugin via claude plugin install (or the auto-update path), the gitCommitSha field in ~/.claude/plugins/installed_plugins.json records the previous HEAD of the marketplace clone rather than the current one. The actual plugin files in the cache are correct — only the SHA bookkeeping is wrong.

Reproduction

1. Publish a plugin to a marketplace repo (e.g., bump version, commit, push)
2. Run claude plugin install <plugin>@<marketplace> or let auto-update pick it up
3. Inspect ~/.claude/plugins/installed_plugins.json

Expected: gitCommitSha matches the HEAD of the marketplace clone (~/.claude/plugins/marketplaces/<name>/.git)

Actual: gitCommitSha is one commit behind — it reflects the SHA from the previous install/update, not the current one.

Evidence

After releasing v2.1.3 (commit 0111ef3):

# Marketplace clone is up to date:
$ git -C ~/.claude/plugins/marketplaces/dotplugins log --oneline -1
0111ef3 chore: release v2.1.3

# Cached files are correct (no diff):
$ diff -r ~/.claude/plugins/cache/dotplugins/dp-cto/2.1.3/ ~/DEV/rd/dotplugins/plugins/dp-cto/
# (no output — files match)

# But installed_plugins.json has the OLD sha:
"dp-cto@dotplugins": [{
  "installPath": "...cache/dotplugins/dp-cto/2.1.3",
  "version": "2.1.3",
  "gitCommitSha": "b156c19..."  // <- this is the v2.1.2 commit
}]

This was also observed on the v2.1.2 release, where the SHA pointed to 4538d6a (a commit from the v1.0.0 era, 13 commits behind HEAD). A full uninstall + cache purge + reinstall fixed the SHA for that release, but the next plugin install update reproduced the problem.

Likely cause

The update flow appears to read the marketplace clone's HEAD SHA before running git pull/git fetch, then writes that stale SHA into installed_plugins.json after copying the (correctly updated) files into the cache.

Impact

• Low for functionality: plugin files are correct, the plugin works fine
• Causes confusion when auditing installed plugin state, since the SHA doesn't match reality
• Could cause issues if any future logic uses gitCommitSha for cache invalidation or update detection

Environment

• macOS (Darwin 25.3.0)
• Claude Code CLI (latest as of 2026-02-25)
• Plugin marketplace: raisedadead/dotplugins