Add explicit cloud catalog refresh before turn admission (#61449)

## Why

Hosts need to refresh cloud plugin and skill catalogs without starting a turn or waiting for step preparation.

## What changed

- Add `CodexThread::refresh_cloud_plugins()` and a turn-independent extension callback that bypass cached catalog reuse and failure cooldowns.
- Run catalog contributors concurrently while serializing publication with step snapshot capture. Invalidate MCP resource caches before explicit discovery and schedule MCP reconciliation afterward.
- Accept complete and partial catalogs, report discovery errors, and keep failed or cancelled refreshes retryable.
- Allow hosts to gate cloud plugin discovery through effective configuration.

## Testing

Add coverage for discovery before turn admission, catalog replacement and reuse, immediate retry after failure, concurrent contributors, and cancellation-safe publication and invalidation.

GitOrigin-RevId: 83e847fcab6562581af2c9e831b1d2a310f2b270

codex-rs/core-plugins/src/marketplace_staging_tests.rs

@@ -60,6 +60,13 @@ fn cleanup_preserves_live_process_and_reclaims_its_abandoned_checkout() -> Resul
     child.stdin.take().unwrap().write_all(b"x")?;
     assert!(child.wait()?.success());
     assert!(payload.exists(), "process exit must bypass TempDir cleanup");
+    // Other tests can fork while the earlier cleanup or checkout creation holds
+    // a lock. Wait for inherited locks and release them before cleanup's try-locks.
+    for name in [CLEANUP_LOCK, COORDINATION_LOCK] {
+        let lock = open_lock(&tmp_root.join(name))?;
+        lock.lock()?;
+        lock.unlock()?;
+    }
     drop(
         crate::configure_trusted_git_repository(
             &mut std::process::Command::new("git"),

codex-rs/core-plugins/src/provider.rs

@@ -13,7 +13,8 @@ use thiserror::Error;
 #[derive(Clone, Debug)]
 pub struct PluginListQuery {
     pub thread_id: String,
-    pub turn_id: String,
+    /// Absent for explicit discovery before turn admission.
+    pub turn_id: Option<String>,
     pub mcp_resources: Option<Arc<McpResourceClient>>,
     /// Already-acquired V2 inventories; empty for cloud listing.
     pub snapshots: Vec<ExecutorCapabilityDiscoveryV2Snapshot>,