Resolve enterprise-managed MCP registrations in the catalog (#45459)

## What changed

- Retain the trusted enterprise identity provider in runtime configuration and bind winning MCP registrations during catalog finalization. Require `features.use_xaa` and a configured identity provider for activation, while preserving existing server restrictions.
- Apply plugin `ema_auth` client, issuer, resource, and scope settings to installed and selected plugins. Disable registrations with mismatched endpoints or empty resources without rewriting plugin endpoints.
- Preserve enterprise auth policy across catalog rebuilds and rebind registrations when materialized server settings change. Keep registration rejection separate from persistent server-name vetoes so it does not disable replacement hosted apps.

## Testing

Add coverage for activation gates, configuration ownership, plugin endpoint validation, catalog rebuilds, and skipping interactive OAuth during installation of enterprise-managed plugins. Stabilize the sandbox network proxy test by reading request headers before closing the loopback connection.

GitOrigin-RevId: 3374f507d120835b285767cedbbb511fc7b0fba2

codex-rs/core-plugins/src/loader.rs

@@ -969,8 +969,8 @@ async fn load_plugin(
 
 fn apply_plugin_mcp_server_policy(config: &mut McpServerConfig, policy: &PluginMcpServerConfig) {
     config.enabled = policy.enabled;
-    if policy.ema_auth.is_some() {
-        config.auth = codex_config::McpServerAuth::EmaAuth;
+    if let Some(ema) = &policy.ema_auth {
+        ema.apply(config);
     }
     if let Some(approval_mode) = policy.default_tools_approval_mode {
         config.default_tools_approval_mode = Some(approval_mode);
@@ -1438,11 +1438,11 @@ pub fn apply_configured_plugin_mcp_server_policies(
 ) {
     for (name, server) in servers {
         if let Some(policy) = policies.get(name) {
-            if policy.ema_auth.is_some() {
-                server.auth = codex_config::McpServerAuth::EmaAuth;
+            server.enabled &= policy.enabled;
+            if let Some(ema) = &policy.ema_auth {
+                ema.apply(server);
             }
             let declared_approval_mode = server.default_tools_approval_mode.unwrap_or_default();
-            server.enabled &= policy.enabled;
 
             if let Some(approval_mode) = policy.default_tools_approval_mode {
                 server.default_tools_approval_mode =