[BUG] apm install <plugin>@<marketplace> ignores a github source's sha and writes an unpinned dependency #3426

Describe the bug

A Claude Code marketplace entry can pin a plugin with sha, a full commit SHA. When the repo has no tags, sha is the only pin. Claude Code's marketplace reference lists ref and sha for github, url and git-subdir sources.

APM resolves such an entry without reading sha. _resolve_github_source and _resolve_git_subdir_source read only ref (resolver.py#L535-L557 at v0.35.0). So:

• apm install resolves the default branch rather than the pinned commit, and warns 1 dependency unpinned.
• It writes the dependency to apm.yml with no ref. The lockfile holds today's commit, and the next apm update moves it.

This is the same on 0.34.0 and 0.35.0, and main still has no read of sha. #2903 is related: it asks for SHA catalog pins in apm marketplace check, and says 0.30.0 wrote owner/repo#sha shorthands. This report is narrower: the install path drops a sha that the catalog already declares.

To Reproduce

1. Make a marketplace repo with .claude-plugin/marketplace.json, then git init and commit it:

   {
     "name": "demo-catalog",
     "owner": { "name": "Demo" },
     "plugins": [{
       "name": "pl-coding",
       "source": {
         "source": "github",
         "repo": "PL-Coding-GmbH/Skills",
         "sha": "c27b5b42c0fa3300d71d17d44e838f0f974ea145"
       }
     }]
   }

2. apm marketplace add <path> --name demo-catalog
3. In an empty project with targets: [agent-skills], run apm install pl-coding@demo-catalog --skill android-navigation.

Actual

[!] 1 dependency unpinned: PL-Coding-GmbH/Skills -- add #tag or #sha to prevent drift

dependencies:
  apm:
    - git: PL-Coding-GmbH/Skills
      skills:
        - android-navigation

Expected

No warning, and the entry is pinned:

    - git: PL-Coding-GmbH/Skills
      ref: c27b5b42c0fa3300d71d17d44e838f0f974ea145
      skills:
        - android-navigation

Workaround

Repeat the SHA as ref in the catalog entry. APM then pins it, and Claude Code accepts both fields and checks out sha.

Environment

APM 0.35.0 and 0.34.0 (via uvx --from apm-cli==<v>), macOS arm64.