[BUG] claude plugin install clones github plugin source over SSH only — no HTTPS fallback (unlike marketplace add)

Summary

claude plugin install resolving a marketplace entry whose source is
{ "source": "github", "repo": "owner/repo" } clones the plugin repo over SSH
(git@github.com:). On a machine without a GitHub SSH key it fails with
Permission denied (publickey) — even for a PUBLIC repo, and even when gh is
authenticated over HTTPS. claude plugin marketplace add on the same machine
succeeds because it falls back to HTTPS (SSH not configured, cloning via HTTPS).
The two code paths are inconsistent.

Environment

• Claude Code 2.1.183 (latest npm release at time of filing)
• macOS (darwin 24.6); no GitHub SSH key configured; gh authenticated via HTTPS

Repro

1. On a machine with no GitHub SSH key (gh logged in over HTTPS):
2. Marketplace repo with entry:

{ "name": "okf", "source": { "source": "github", "repo": "betmoar/cc-okf-plugin" } }
(plugin repo is public)

1. claude plugin marketplace add betmoar/ccp-market

→ succeeds; logs SSH not configured, cloning via HTTPS

1. claude plugin install okf

→ fails: Failed to clone repository: ... git@github.com: Permission denied (publickey)

Expected

install clones the github source over HTTPS (or falls back to HTTPS when SSH is
unavailable), consistent with marketplace add. Public repos should install with
no SSH key.

Actual

install only attempts SSH; no HTTPS fallback → fails.

Workaround

git config --global url."https://github.com/".insteadOf "git@github.com:"
rewrites the SSH clone to HTTPS; install then succeeds. (Verified.)

Note

Other source forms ("source": "https://github.com/owner/repo", or
{ "source": "git", "url": "https://....git" }) are rejected at install with
"This plugin uses a source type your Claude Code version does not support," so
there is no catalog-side way to force HTTPS.

Suggested fix

Give install the same SSH→HTTPS fallback marketplace add already has (or honor
HTTPS / the user's git credential setup for github sources).