--plugin-dir does not override marketplace plugin with same name

Root Cause Confirmed

The userConfig block in plugin.json with "sensitive": true causes Claude Code to force-load the marketplace-installed plugin instead of honoring --plugin-dir.

Reproduction

1. Install a plugin from the marketplace that has userConfig with "sensitive": true in its plugin.json
2. Clone the same plugin's source locally
3. Run claude --plugin-dir /path/to/local/clone
4. Skills resolve ${CLAUDE_PLUGIN_ROOT} to the marketplace path, not the --plugin-dir path

Fix that confirms

Removing the userConfig block from the local plugin's plugin.json restores --plugin-dir override behavior. Skills then correctly resolve ${CLAUDE_PLUGIN_ROOT} to the local path.

Expected Behavior

--plugin-dir should override the marketplace plugin regardless of userConfig presence. Secret bindings from the marketplace installation should be available to the --plugin-dir version when the plugin name matches.