Attribute command executions to trusted plugin scripts (#35020)

## What changed

- Resolve shell and unified-exec commands against the trusted plugin roots loaded for each turn.
- Add optional `pluginId` and safe plugin-relative `scriptPath` fields to command execution items and legacy execution events, and propagate them through app-server notifications.
- Include the attribution in command execution analytics while rejecting absolute, unsafe, and unattributed script paths.

## Testing

- Cover attribution for cached curated and remote plugin scripts from command execution through core and app-server events.
- Verify analytics serialization and unsafe-path filtering.

GitOrigin-RevId: 02fac3a233284ccfc6642fa502a95f1881dba83d

codex-rs/exec/tests/event_processor_with_json_output.rs

@@ -173,6 +173,8 @@ fn command_execution_started_and_completed_translate_to_thread_events() {
         command: "ls".to_string(),
         cwd: test_path_buf("/tmp/project").abs().into(),
         process_id: Some("123".to_string()),
+        plugin_id: None,
+        script_path: None,
         source: CommandExecutionSource::UserShell,
         status: ApiCommandExecutionStatus::InProgress,
         command_actions: Vec::<CommandAction>::new(),
@@ -213,6 +215,8 @@ fn command_execution_started_and_completed_translate_to_thread_events() {
                 command: "ls".to_string(),
                 cwd: test_path_buf("/tmp/project").abs().into(),
                 process_id: Some("123".to_string()),
+                plugin_id: None,
+                script_path: None,
                 source: CommandExecutionSource::UserShell,
                 status: ApiCommandExecutionStatus::Completed,
                 command_actions: Vec::<CommandAction>::new(),
@@ -1335,6 +1339,8 @@ fn turn_completion_reconciles_started_items_from_turn_items() {
                 command: "ls".to_string(),
                 cwd: test_path_buf("/tmp/project").abs().into(),
                 process_id: Some("123".to_string()),
+                plugin_id: None,
+                script_path: None,
                 source: CommandExecutionSource::UserShell,
                 status: ApiCommandExecutionStatus::InProgress,
                 command_actions: Vec::<CommandAction>::new(),
@@ -1375,6 +1381,8 @@ fn turn_completion_reconciles_started_items_from_turn_items() {
                     command: "ls".to_string(),
                     cwd: test_path_buf("/tmp/project").abs().into(),
                     process_id: Some("123".to_string()),
+                    plugin_id: None,
+                    script_path: None,
                     source: CommandExecutionSource::UserShell,
                     status: ApiCommandExecutionStatus::Completed,
                     command_actions: Vec::<CommandAction>::new(),