Unify plugin skill loading with the host skill service (#37444)

## What changed

- Inject the host skill loader into `PluginsManager` so plugin discovery and agent turns use the same loading and product-policy behavior.
- Share plugin skill snapshots across those paths, preserving a consistent view of skills across workspaces.
- Apply migrated-command precedence after product filtering, allowing an eligible migrated command to replace a filtered native skill with the same name.

## Testing

- Add coverage for product-restricted plugin skills, native-versus-migrated command precedence, and the skills exposed to agent turns.

GitOrigin-RevId: f5ef0d0766ebeeb30d73ffaf044d003c2906ea4d

codex-rs/core-plugins/src/skill_snapshots.rs

@@ -0,0 +1,34 @@
+use std::collections::HashMap;
+use std::sync::Arc;
+use std::sync::Mutex;
+
+use codex_skills::LoadedSkillRoot;
+use codex_skills::SkillRootSnapshotCache;
+use codex_skills::SkillRootSnapshots;
+use codex_utils_plugins::PluginSkillRoot;
+
+#[derive(Default)]
+struct PluginSkillSnapshotCache {
+    snapshots_by_root: Mutex<HashMap<PluginSkillRoot, LoadedSkillRoot>>,
+}
+
+impl SkillRootSnapshotCache<PluginSkillRoot> for PluginSkillSnapshotCache {
+    fn get(&self, root: &PluginSkillRoot) -> Option<LoadedSkillRoot> {
+        self.snapshots_by_root
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .get(root)
+            .cloned()
+    }
+
+    fn insert(&self, root: PluginSkillRoot, snapshot: LoadedSkillRoot) {
+        self.snapshots_by_root
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .insert(root, snapshot);
+    }
+}
+
+pub(crate) fn new_plugin_skill_snapshots() -> SkillRootSnapshots<PluginSkillRoot> {
+    SkillRootSnapshots::new(Arc::new(PluginSkillSnapshotCache::default()))
+}