claude plugin update reports "already at the latest version" with no fallback when a marketplace's declared version string doesn't change, even though real commits landed

Summary

claude plugin update <plugin>@<marketplace> (and the /plugin marketplace
update <marketplace> + /reload-plugins flow) determine whether a plugin
needs updating purely by comparing the marketplace's declared plugin.json
version string against the recorded installed version. There's no fallback
check against the actual underlying git state, so if a marketplace's source
moves forward without bumping that version string (e.g. a maintainer merges
real fixes but forgets the version bump), the update command confidently
reports "already at the latest version" and the plugin cache is never
refreshed — even though real content changed.

Repro

1. Install a plugin from a git-backed marketplace; ~/.claude/plugins/installed_plugins.json

records version and gitCommitSha at install time.

1. Have the marketplace's upstream repo gain new commits under that plugin's

directory, without the plugin's own plugin.json version field changing.

1. Run /plugin marketplace update <marketplace> — confirms the local

marketplace clone fetches forward correctly (git log in
~/.claude/plugins/marketplaces/<marketplace> shows the new commits).

1. Run /reload-plugins, or claude plugin update <plugin>@<marketplace>

directly:
``
Checking for updates for plugin "<plugin>@<marketplace>" at user scope…
✔ <plugin> is already at the latest version (X.Y.Z).
``

1. Check the actual runtime cache at

~/.claude/plugins/cache/<marketplace>/<plugin>/<version>/ — file
contents/mtimes are unchanged from before step 3; installed_plugins.json's
gitCommitSha also never updates.

Observed concretely with tableau-to-sigma@sigma-migration-skills:
marketplace clone moved 26 commits ahead (5 confirmed bug-fix commits present
in its own copy of the plugin), plugin.json version stayed 1.0.0, claude
plugin update reported already-current, and the runtime cache stayed
byte-identical (confirmed via mtime + content grep). The only way to force a
real refresh was a full claude plugin uninstall + claude plugin install.

Impact

A marketplace that's careless about bumping plugin.json version (a real,
observed case, not hypothetical) causes claude plugin update to silently
lie — consumers have no visible signal that they're missing fixes that have
actually landed, short of manually diffing the cache against the marketplace
source themselves.

Suggested fix

Since installed_plugins.json already records a gitCommitSha at
install/update time, claude plugin update could compare that against the
marketplace's current HEAD commit that last touched the plugin's directory as
an additional signal beyond the declared version string — at minimum, warn
("this plugin's version is unchanged, but its marketplace source has moved —
consider a full reinstall") rather than reporting a clean "already at the
latest version" when the underlying commit has clearly moved. A full
drift-aware refresh would be the stronger fix, but even a warning would
prevent the silent false-negative we hit here.

Also worth knowing

Filed a companion issue on the marketplace's own repo
(twells89/sigma-migration-skills#486)
asking them to actually bump plugin.json's version on release — this issue
is about Claude Code's update check having no fallback when they (or any
other marketplace) don't.