Pin plugin installs to git commit SHA via marketplace.json

Feature Request

Add an optional sha field to plugin entries in .claude-plugin/marketplace.json that locks the installed plugin to a specific git commit. When set, fresh installs and auto-updates would use the code at that exact commit rather than HEAD.

Problem

Currently, the version field in plugin.json is the sole cache key for installed plugins. Between version bumps, fresh installs copy whatever code is at HEAD into the cache under the current version string. This creates silent divergence: two users both on the same version can have different code depending on when they installed.

Example:

1. Plugin developer releases v1.0.0
2. Developer pushes several commits (bug fixes, experiments) without bumping version
3. User A installed v1.0.0 last week — has the original release code
4. User B installs v1.0.0 today — gets HEAD code cached under "v1.0.0"
5. Both users report version 1.0.0, but have different code

Proposed Solution

Allow plugin developers to pin a version to a specific commit in marketplace.json:

{
  "plugins": [
    {
      "name": "my-plugin",
      "version": "1.0.0",
      "sha": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0",
      "source": "./plugins/my-plugin"
    }
  ]
}

When sha is present:

• Fresh installs check out that exact commit when copying to cache
• Auto-updates compare the installed SHA against the marketplace SHA
• The version string remains human-readable but the SHA ensures reproducibility

The sha field already exists for external plugin sources (documented for github source type). This request extends that behavior to relative-path plugins within a marketplace.

Benefits

• Reproducible installs: Every user on v1.0.0 has identical code
• Explicit releases: Developer updates both version and sha when releasing
• Backward compatible: Field is optional; omitting it preserves current HEAD behavior

Context

Discovered through empirical testing of plugin update mechanics on Claude Code 2.1.74. Full test results: https://github.com/anthropics/claude-code/issues/26744#issuecomment-4047395059