fix(update-check): resolve the release URL for a relative plugin source

This project's marketplace entry is `"source": "./"` — the plugin IS the
marketplace repo — but pluginMarketplaceUrl only accepted a URL string or
`{url}`, so it returned null and every plugin-cache install answered
`no_remote`: no install of this plugin could ever see a published release.

A relative source now falls back to the manifest's own `repository`. An
`owner/repo` shorthand still returns null — it names a different repo, so
borrowing the marketplace's URL would be a confidently wrong answer.

server/__tests__/update-check-plugin-nogit.test.js

@@ -64,6 +64,7 @@ function makePluginInstall(name, opts = {}) {
     source = { source: "url", url: "https://forge.example.com/Owner/Repo.git", ref: "main" },
     version = "1.5.1",
     knownMarketplaces = true,
+    repository,
   } = opts;
 
   const home = path.join(tmpDir, name, ".claude");
@@ -74,7 +75,7 @@ function makePluginInstall(name, opts = {}) {
 
   fs.writeFileSync(
     path.join(mktDir, ".claude-plugin", "marketplace.json"),
-    JSON.stringify({ name: "sg", plugins: [{ name: "agenthub", source }] })
+    JSON.stringify({ name: "sg", repository, plugins: [{ name: "agenthub", source }] })
   );
   if (knownMarketplaces) {
     fs.writeFileSync(
@@ -128,10 +129,31 @@ describe("pluginMarketplaceUrl", () => {
     );
   });
 
+  it("falls back to the marketplace's repository for a relative source", () => {
+    // This project's own entry is `"source": "./"` — the plugin IS the
+    // marketplace repo. Without this the dashboard answered `no_remote` and
+    // could never see a release on any plugin-cache install.
+    makePluginInstall("relsrc", {
+      source: "./",
+      repository: "https://forge.example.com/Owner/Repo",
+    });
+    assert.equal(pluginMarketplaceUrl("sg", "agenthub"), "https://forge.example.com/Owner/Repo");
+  });
+
+  it("returns null for a relative source when the manifest declares no repository", () => {
+    makePluginInstall("relnorepo", { source: "./plugins/agenthub" });
+    assert.equal(pluginMarketplaceUrl("sg", "agenthub"), null);
+  });
+
   it("returns null for a github owner/repo shorthand rather than guessing a host", () => {
     // Inventing github.com here would produce an API URL that 404s and a
     // confidently wrong "up to date".
-    makePluginInstall("ghshort", { source: { source: "github", repo: "Owner/Repo" } });
+    // Not even when the marketplace declares a repository: a shorthand source
+    // names a DIFFERENT repo, so borrowing the marketplace's is a wrong answer.
+    makePluginInstall("ghshort", {
+      source: { source: "github", repo: "Owner/Repo" },
+      repository: "https://forge.example.com/Owner/Marketplace",
+    });
     assert.equal(pluginMarketplaceUrl("sg", "agenthub"), null);
   });