Add configurable default plugin activation policy (#52220)

## What changed

Support `plugins._default.enabled` with explicit per-plugin `enabled` overrides. Omission preserves existing source and account enablement; configuration cannot activate a plugin disabled at its source. Plugin settings such as remembered tool approvals inherit the default unless `enabled` is explicitly set.

Apply the policy to plugin skills, MCP servers, Apps, and hooks, including selected executor roots and runtime configuration refreshes. Preserve the latest plugin policy when adding MCP dependencies and rebuild hooks when concurrent configuration updates replace their inputs.

Report effective enablement in `plugin/list`, `plugin/installed`, `plugin/read`, and `plugin/share/list`. Remote installation still installs disabled packages, but skips MCP and Apps authentication setup without writing an enablement override.

## Testing

Add regression coverage for default inheritance and explicit overrides, source-disabled plugins, policy refreshes during active turns, disabled or malformed selected plugin roots, and remote installation authentication behavior.

GitOrigin-RevId: 83b70c5b47fc95474fec292f248683f1f887221e

codex-rs/ext/extension-api/src/contributors.rs

@@ -2,6 +2,7 @@ use std::future::Future;
 use std::pin::Pin;
 use std::sync::Arc;
 
+use codex_config::types::PluginsConfigToml;
 use codex_context_fragments::ContextualUserFragment;
 use codex_protocol::items::TurnItem;
 use codex_protocol::protocol::TokenUsageInfo;
@@ -92,10 +93,12 @@ pub trait McpServerContributor<C: Sync>: Send + Sync {
     /// Declares executor plugins, including those without MCP servers or connectors. Each
     /// declaration identifies the plugin once; its deferred MCP data cannot change that identity.
     /// Return plugins in precedence order: across contributors in registration order, the first
-    /// plugin wins if several provide the same server.
+    /// plugin wins if several provide the same server. Use the supplied plugin policy for both
+    /// admission and deferred projection; a step's policy may be newer than its other config.
     fn selected_plugins<'a>(
         &'a self,
         _context: McpServerContributionContext<'a, C>,
+        _plugins_config: &'a PluginsConfigToml,
     ) -> ExtensionFuture<'a, Vec<SelectedPlugin<'a>>> {
         Box::pin(async { Vec::new() })
     }