autoUpdate: true in known marketplaces does not pull new commits on startup

## Description

When a marketplace is registered with `"autoUpdate": true` in `known_marketplaces.json`, Claude Code does not pull new commits from the remote on startup. Installed plugins remain pinned to the commit SHA from when the marketplace was first cloned.

## Reproduction

1. Install a plugin from a git-backed marketplace
2. Note the `gitCommitSha` in `~/.claude/plugins/installed_plugins.json`
3. New commits are merged to the marketplace repo's default branch
4. Restart Claude Code
5. **Expected:** plugin cache updates to the new HEAD commit
6. **Actual:** `gitCommitSha` and `installPath` remain unchanged; new skills are not available

## Environment

- `~/.claude/plugins/known_marketplaces.json` has `"autoUpdate": true`
- `lastUpdated` in that file does not advance on restarts
- The marketplace git clone under `~/.claude/plugins/marketplaces/` is also not pulled

## Workaround

We wrote a `SessionStart` hook that manually runs `git pull` on marketplace clones and patches `installed_plugins.json` directly. This works but mutates a file owned by Claude Code with no API contract.

## Impact

Users on managed deployments (e.g. JAMF) never receive plugin updates after initial install without manual cache-busting (`rm -rf ~/.claude/plugins/cache//`).

Start by tracing startup handling for autoUpdate in known_marketplaces.json, then inspect how marketplace clones and installed_plugins.json are updated. Verify the behavior with a git-backed marketplace: on restart, the clone should pull the default branch and the plugin cache, gitCommitSha, installPath, and lastUpdated should reflect the new commit.

由索引模型根据 Issue 内容生成。