Refresh runtimes for remote plugin state changes (#41396)

## Why

Enabling, disabling, or reinstalling a cached remote plugin can change its
effective MCP servers, hooks, and skills without materializing a new bundle.
These transitions need to invalidate plugin consumers just like bundle updates
and removals do.

## What changed

- Report a unified set of changed remote plugins and their affected
  capabilities for materializations, removals, and installed-state changes.
- Derive enablement and reinstall changes by comparing installed snapshots,
  while keeping materialization metadata separate for hook trust handling.
- Preserve removal notifications even when stale cache cleanup fails, and use
  all reported changes to refresh loaded plugin state and runtime consumers.

## Testing

Added coverage for cached plugin enablement, disablement, removal, and
reinstallation, including removal when cache cleanup cannot complete.

GitOrigin-RevId: 86d9c1356f7cf70b3c85effebc3e5986b931bdba

codex-rs/app-server/src/effective_plugin_change_tests.rs

@@ -14,7 +14,6 @@ fn only_workspace_listed_materializations_are_eligible() {
                 scope,
                 discoverability,
                 authenticated_account_id: Some("account-123".to_string()),
-                capabilities: Default::default(),
             }
         };