autoUpdate: true in known marketplaces does not pull new commits on startup

Description

When a marketplace is registered with "autoUpdate": true in known_marketplaces.json, Claude Code does not pull new commits from the remote on startup. Installed plugins remain pinned to the commit SHA from when the marketplace was first cloned.

Reproduction

1. Install a plugin from a git-backed marketplace
2. Note the gitCommitSha in ~/.claude/plugins/installed_plugins.json
3. New commits are merged to the marketplace repo's default branch
4. Restart Claude Code
5. Expected: plugin cache updates to the new HEAD commit
6. Actual: gitCommitSha and installPath remain unchanged; new skills are not available

Environment

• ~/.claude/plugins/known_marketplaces.json has "autoUpdate": true
• lastUpdated in that file does not advance on restarts
• The marketplace git clone under ~/.claude/plugins/marketplaces/ is also not pulled

Workaround

We wrote a SessionStart hook that manually runs git pull on marketplace clones and patches installed_plugins.json directly. This works but mutates a file owned by Claude Code with no API contract.

Impact

Users on managed deployments (e.g. JAMF) never receive plugin updates after initial install without manual cache-busting (rm -rf ~/.claude/plugins/cache/<marketplace>/<plugin>).