Plugin SHA Pin Verification: Clearer Errors

When installing a plugin that specifies a SHA pin and verification fails, the error message is now specific about what went wrong:

SHA pin verification failed: expected HEAD to be <expected-sha>, got <actual-sha>.
The pinned commit may have been removed upstream, or a ref with the same name exists.
Refusing to install.

If the underlying git rev-parse call itself fails, the got field shows (rev-parse failed) so the root cause is always clear.