fix(updates): give a plugin-cache install a real message, not null

`agenthub update-check` prints `message` as its headline, so every
plugin-cache install saw the literal "null" where the verdict belongs — and
that is the one install kind with no commit count to fall back on, so the
line carried nothing at all.

The plugin branch of getUpdatesStatus compares versions exactly like the
checkout branch does; it now builds the same four sentences from what it
already computed (newer release / newest / no local version to compare /
release lookup failed).

The nogit regression test asserted `message === null` as a proxy for "did
not fall through to the not-a-git-clone payload" — it now asserts that on
the message's content instead, which is what it always meant.

server/lib/update-check.js

@@ -402,7 +402,17 @@ async function pluginStatus(root, pluginInstall, options = {}) {
       `commands — "Update now" runs them for you and restarts the dashboard. An already-open ` +
       `Claude Code session still needs '/reload-plugins' to pick up new skills and commands.`,
     manual_command: manualParts.join(" && "),
-    message: null,
+    // A plugin install compares versions exactly like a checkout does, so it
+    // gets the same sentence. Left null, `agenthub update-check` printed the
+    // literal "null" as its headline on every plugin-cache install — the one
+    // install kind that cannot fall back to a commit count.
+    message: releaseIsNewer
+      ? `Release ${release.tag} is available (this install reports ${localVersion || "no version"}).`
+      : comparable
+        ? `Running the newest release (${release.tag}).`
+        : release.ok
+          ? `This install reports no version, so it cannot be compared with release ${release.tag}.`
+          : `Could not read the latest release (${release.reason}); version comparison unavailable.`,
 
     install_kind: "plugin",
     plugin_marketplace: pluginInstall.marketplace,