Resolve enterprise-managed MCP registrations in the catalog (#45459)

## What changed

- Retain the trusted enterprise identity provider in runtime configuration and bind winning MCP registrations during catalog finalization. Require `features.use_xaa` and a configured identity provider for activation, while preserving existing server restrictions.
- Apply plugin `ema_auth` client, issuer, resource, and scope settings to installed and selected plugins. Disable registrations with mismatched endpoints or empty resources without rewriting plugin endpoints.
- Preserve enterprise auth policy across catalog rebuilds and rebind registrations when materialized server settings change. Keep registration rejection separate from persistent server-name vetoes so it does not disable replacement hosted apps.

## Testing

Add coverage for activation gates, configuration ownership, plugin endpoint validation, catalog rebuilds, and skipping interactive OAuth during installation of enterprise-managed plugins. Stabilize the sandbox network proxy test by reading request headers before closing the loopback connection.

GitOrigin-RevId: 3374f507d120835b285767cedbbb511fc7b0fba2

codex-rs/cli/tests/sandbox_network_proxy.rs

@@ -82,6 +82,20 @@ fn sandbox_with_network_proxy_allows_explicit_loopback_access() -> Result<()> {
         loop {
             match listener.accept() {
                 Ok((mut stream, _)) => {
+                    // Closing with unread request bytes can reset the connection and yield a 502.
+                    stream.set_nonblocking(false)?;
+                    stream.set_read_timeout(Some(Duration::from_secs(5)))?;
+                    let mut request = Vec::new();
+                    let mut buffer = [0_u8; 1024];
+                    while !request.windows(4).any(|window| window == b"\r\n\r\n") {
+                        let bytes_read = std::io::Read::read(&mut stream, &mut buffer)?;
+                        if bytes_read == 0 || request.len() + bytes_read > 64 * 1024 {
+                            return Err(std::io::Error::other(
+                                "incomplete or oversized loopback request headers",
+                            ));
+                        }
+                        request.extend_from_slice(&buffer[..bytes_read]);
+                    }
                     std::io::Write::write_all(
                         &mut stream,
                         b"HTTP/1.1 204 No Content\r\nContent-Length: 0\r\n\r\n",