Plugin install can verify declared binary hashes and skip republishing

What

• The plugin publish/move logic now returns an explicit "published" status, and for plugins without strictCache, it takes a faster path that drops the staged clone's .git directory and installs directly, bypassing the version-cache rename process used for strictCache plugins.
• When a plugin's manifest declares binaries and a feature check passes, install now passes a binariesHook with the declared sha256 hash map into the staging/publish step, and can report the result as "kept" (skipping republish) when the hashes already match.

Why

Verifying binary hashes before republishing avoids unnecessary rewrites of unchanged binary files during plugin installs, making installs faster and safer for plugins that ship binaries.