Run allowlisted executor plugin stop hooks (#40009)

## What changed

- Discover inline hooks from executor-provided plugin manifests and accept only
  the bundled Computer Use `Stop` hook for `node_repl.turn_ended`.
- Add the accepted hook to the current step's hook engine with
  executor-scoped provenance.
- Run executor-scoped hooks in the background after regular stop-hook
  decisions, without delaying turn completion, applying control effects, or
  exposing them in hook summaries. Skip them when regular hooks only block
  continuation.

## Testing

- Added coverage for manifest filtering and option preservation.
- Added coverage for background execution, interaction with regular stop
  hooks, and non-blocking turn completion.

GitOrigin-RevId: c0f75f83a23ba8a83bb3a5d5997c4882aacc32d6

codex-rs/plugin/src/lib.rs

@@ -11,6 +11,7 @@ mod provider;
 
 use codex_config::HookEventsToml;
 use codex_utils_absolute_path::AbsolutePathBuf;
+use codex_utils_path_uri::PathUri;
 pub use load_outcome::LoadedPlugin;
 pub use load_outcome::PluginLoadOutcome;
 pub use load_outcome::prompt_safe_plugin_description;
@@ -67,6 +68,17 @@ pub struct PluginHookSource {
     pub hooks: HookEventsToml,
 }
 
+/// Inline plugin hooks whose paths and MCP target belong to an executor environment.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ExecutorPluginHookSource {
+    pub plugin_id: PluginId,
+    pub environment_id: String,
+    pub plugin_root: PathUri,
+    pub manifest_path: PathUri,
+    pub source_relative_path: String,
+    pub hooks: HookEventsToml,
+}
+
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct PluginTelemetryMetadata {
     /// Local plugin identifier used by Codex configuration and the plugin cache,