Add descriptor commit validation regression coverage

[cursor]

Summary

• Add a focused packager regression test for plugin descriptors that omit commit.
• Tighten descriptor validation so a missing commit produces the existing PluginBuildException path instead of an incidental null matcher failure.

Risky behavior now covered

• New or updated plugin manifest files without a commit are rejected deterministically with actionable packager output.

Test files added/updated

• package/package/src/test/java/net/runelite/pluginhub/packager/PluginTest.java

Why this reduces regression risk

• Every plugin add/update depends on descriptor parsing before any build work starts. Covering the missing required commit field protects a high-volume core validation path from regressing into unclear crashes.

Validation

• Passed: ./gradlew --console=plain prep && ./gradlew --console=plain :package:test --tests net.runelite.pluginhub.packager.PluginTest.testCommitIsRequired
• Broader local run: ./gradlew --console=plain :package:test reaches existing example-plugin integration tests but fails in this environment while compiling generated example plugins. The automation VM only has Java 21 installed, while repository CI config uses Java 11.