Plugin scope incorrectly shown as 'Local' instead of 'User' in new sessions

Bug Description

When installing a plugin with --scope user via /plugin, the plugin correctly shows as "User" scope in the installing session. However, when opening a different session (or different project), the same plugin is displayed as "Local" scope instead of "User".

This also causes uninstall to fail because it tries to remove from "local" scope while the plugin is actually in user scope:

Failed to uninstall: Plugin "security-guidance@claude-plugins-official" is not installed in local scope.
Use --scope to specify the correct scope.

Steps to Reproduce

1. Run /plugin and install a plugin (e.g., security-guidance@claude-plugins-official) with user scope
2. Verify it shows as "User" in the plugin list → ✅ correct
3. Open a new session (or navigate to a different project)
4. Run /plugin → Installed tab shows the plugin under "Local" instead of "User"
5. Try to uninstall → fails with scope mismatch error

Root Cause (Hypothesis)

~/.claude/settings.json stores enabledPlugins without scope metadata:

"enabledPlugins": {
  "security-guidance@claude-plugins-official": true
}

The scope is only held in-memory during the installing session. When a new session loads plugins from settings.json, it cannot determine the original scope and falls back to "local".

Expected Behavior

• Plugins installed at user scope should always display as "User" across all sessions
• Uninstall should work without requiring manual --scope override

Environment

• Claude Code CLI
• macOS (Darwin 25.3.0)