Move plugin recommendations into developer context (#47349)

## What changed

Emit `<recommended_plugins>` with the `developer` role and append it to the shared developer message after other context. Retain recognition of legacy user-role recommendations in existing rollouts.

## Testing

Add a startup context snapshot and assertions that recommendations share the developer message with permissions instructions. Update core and app-server tests to check developer-role recommendations, including across successive model requests.

GitOrigin-RevId: 0326ff347e86ec38b948f93e39e90e6a88a8730c

codex-rs/app-server/tests/suite/v2/recommended_plugins.rs

@@ -13,6 +13,7 @@ use codex_app_server_protocol::TurnStartParams;
 use codex_app_server_protocol::UserInput;
 use core_test_support::apps_test_server::AppsTestServer;
 use core_test_support::responses;
+use pretty_assertions::assert_eq;
 use serde_json::Value;
 use serde_json::json;
 use std::time::Duration;
@@ -170,9 +171,20 @@ async fn recommended_plugins_after_external_login(
                 .any(|text| text.contains("suggest a plugin"))
         })
         .expect("turn request");
-    let contextual_user_message = request.message_input_texts("user").join("\n");
-    assert!(contextual_user_message.contains("<recommended_plugins>"));
-    assert!(contextual_user_message.contains("- GitHub (github@openai-curated-remote)"));
+    let recommendations = request
+        .message_input_texts("developer")
+        .into_iter()
+        .filter(|text| text.starts_with("<recommended_plugins>"))
+        .collect::<Vec<_>>();
+    assert_eq!(
+        recommendations,
+        vec![concat!(
+            "<recommended_plugins>\n",
+            "Here is a list of plugins that are available but not installed.\n\n",
+            "- GitHub (github@openai-curated-remote)\n",
+            "</recommended_plugins>",
+        )]
+    );
     let body = request.body_json();
     let tool_names = body
         .get("tools")