a set of fields keyed off the plugin's install location, sent with both events
the plugin's git commit SHA, sent with the update event only
This builds on the marketplace-catalog verification step added earlier, which confirms a plugin exists in the marketplace before logging it and otherwise falls back to a redacted, third-party record.
Why
Recording the install location and commit SHA gives more precise identification of exactly which plugin version was installed or updated, on top of the existing marketplace verification.
