[BUG] Plugin version taken from parent git repo when marketplace folder has no .git (fake updates when ~/.claude is a git repo)

Environment

• Claude Code 2.1.245
• Windows 11 (Git Bash)
• ~/.claude is itself a git repository (used to version CLAUDE.md, settings.json and rules; everything else is gitignored)

What happens

The claude-plugins-official marketplace is stored at ~/.claude/plugins/marketplaces/claude-plugins-official without a .git folder. The other GitHub marketplaces (caveman, esqlabs) are real clones with their own .git.

When Claude Code resolves the version of a plugin from that marketplace, git walks up the directory tree and finds the ~/.claude repository. The plugin version becomes the HEAD commit of the user's config repo, not a commit of anthropics/claude-plugins-official.

$ git -C ~/.claude/plugins/marketplaces/claude-plugins-official rev-parse --show-toplevel
C:/Users/<user>/.claude

Result: every commit to the ~/.claude repo makes code-review and feature-dev report an update, although nothing changed upstream.

$ claude plugin update code-review@claude-plugins-official
✔ Plugin "code-review" updated from fbe07fb6ce7d to 903be3b6f5aa for scope user. Restart to apply changes.

903be3b6f5aa is a merge commit in my own config repository. The old and new cache folders contain the same files (diff -rq only lists the .in_use and .orphaned_at markers), and a new cache folder is left behind on each fake update. ~/.claude/plugins/cache/claude-plugins-official/code-review/ has 8 version folders so far.

superpowers@claude-plugins-official declares an explicit version (6.4.1) and is not affected.

Steps to reproduce

1. git init ~/.claude and make a commit.
2. Install code-review@claude-plugins-official (marketplace downloaded without .git).
3. Make another commit in ~/.claude.
4. Run claude plugin update code-review@claude-plugins-official: it "updates" to the new ~/.claude HEAD.

Expected

The version of a plugin from a marketplace without its own .git should not come from an unrelated parent repository. For example, stop git discovery at the marketplace folder (GIT_CEILING_DIRECTORIES, or check that --show-toplevel equals the marketplace path), or use the marketplace's own commit or version metadata.