Ops: pin Official catalog pluginRef (tags/commits) after #177

[ReBoticsAI]

Summary

Follow-up ops work from #177 (Marketplace buyer protection).

Official/Community plugin installs now fail closed unless the catalog entry has an immutable pluginRef (release tag or commit sha). Optional pluginDigest must match HEAD. Floating main / master / empty is rejected.

Goal

Curate GodMode Cloud Official catalog rows (and any public Official feed entries used by SaaS) so every plugin installType entry has a real pin, not main.

Acceptance

• Audit active Official catalog plugin entries for missing or floating plugin_ref / pluginRef
• Set each to a release tag or commit sha (and pluginDigest where useful)
• Confirm a free Official plugin install succeeds on Cloud after pins
• Document operator checklist in MARKETPLACE.md or admin UI copy if needed

Related

• Marketplace buyer protection: pinned install + plugin runtime least privilege #177 (shipped pin enforcement)
• Marketplace: plugin capability allowlists (network deny-by-default) #290 (capability allowlists follow-up)

Out of scope

Changing the pin fail-closed policy; Local/Unofficial folder installs.