[BUG] Use SHA as marketplace ref cause git clone --branch error

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

I wanted to use SHA as ref which is mentioned in the document but failed.
https://code.claude.com/docs/en/settings#strictknownmarketplaces

Plugin Error:

   ❯ anthropic-agent-skills (user)
      Failed to clone marketplace repository: Cloning into '/Users/g/.claude/plugins/marketplaces/temp_1776685439892'...
      warning: Could not find remote branch 0f7c287eaf0d4fa511cb871bb55e2a7862251fbb to clone.
      fatal: Remote branch 0f7c287eaf0d4fa511cb871bb55e2a7862251fbb not found in upstream origin

What Should Happen?

Claude code should clone the repo and then checkout by SHA, not using git clone --branch to clone the SHA ref.

Error Messages/Logs

❯ anthropic-agent-skills (user)
      Failed to clone marketplace repository: Cloning into '/Users/g/.claude/plugins/marketplaces/temp_1776685439892'...
      warning: Could not find remote branch 0f7c287eaf0d4fa511cb871bb55e2a7862251fbb to clone.
      fatal: Remote branch 0f7c287eaf0d4fa511cb871bb55e2a7862251fbb not found in upstream origin

Steps to Reproduce

My managed-settings.json

{
  "strictKnownMarketplaces": [
    {
        "source": "git",
        "url": "https://github.com/anthropics/skills.git",
        "ref": "0f7c287eaf0d4fa511cb871bb55e2a7862251fbb"
    }
  ],
  "enabledPlugins": {
    "document-skills@anthropic-agent-skills": false,
    "claude-api@anthropic-agent-skills": false
  }
}

My ~/.claude/settings.json:

{
  "enabledPlugins": {
    "example-skills@anthropic-agent-skills": true
  },
  "extraKnownMarketplaces": {
    "anthropic-agent-skills": {
      "source" :  {
        "source": "git",
        "url": "https://github.com/anthropics/skills.git",
        "ref": "0f7c287eaf0d4fa511cb871bb55e2a7862251fbb"
      }
    }
  },
  "skipDangerousModePermissionPrompt": true
}

### Claude Model

None

### Is this a regression?

No, this never worked

### Last Working Version

_No response_

### Claude Code Version

2.1.114

### Platform

Anthropic API

### Operating System

macOS

### Terminal/Shell

iTerm2

### Additional Information

The goal of doing this is control the plugins strictly so that plugins added to marketplace in the future won't be enabled automatically.