Reconcile V2 executor plugins with cloud catalogs (#55301)

## What changed

- Use V2 discovery inventories for plugin MCP contributions when supplied, including empty or failed inventories; retain legacy discovery when no V2 snapshot is supplied.
- Merge plugins by canonical identity, using cloud metadata and enablement for remote plugins and attaching executor installations only when versions match. Preserve configured executor-local plugins and executor enablement when cloud data is unavailable.
- Keep installation order stable across refreshes and run merged MCP declarations on the first retained executor installation while preserving attribution for the others.
- Carry local and remote identities through selected-plugin snapshots, skill attribution, and active-plugin telemetry. Track disabled plugin IDs alongside disabled roots.
- Preserve a complete cloud catalog when a partial refresh arrives, and cap tool-description plugin attribution at 1,024 bytes while retaining all plugin associations.

## Testing

Add coverage for catalog parsing and reconciliation, enablement and discovery-mode selection, installation refresh ordering, executor-specific MCP normalization, selected-plugin snapshots, and bounded UTF-8 attribution text.

GitOrigin-RevId: a8ad352de6a2b8dc4bfd1ff6a5c62ee8ed1d1664

codex-rs/core/src/session/active_plugin_inventory_tests.rs

@@ -79,7 +79,9 @@ async fn active_plugin_ids_select_and_validate_by_source() {
             .into_iter()
             .map(|plugin_id| SelectedPluginIdentity {
                 selected_root_id: Some("capability-root".to_string()),
-                plugin_id: plugin_id.to_string(),
+                plugin_id: codex_core_plugins::PluginIdentity::Local {
+                    plugin_id: plugin_id.to_string(),
+                },
             })
             .collect::<Vec<_>>();
         turn_context.active_host_plugin_identities = Some(identities);
@@ -125,7 +127,9 @@ async fn active_plugin_ids_enforce_bounds_after_selection_and_deduplication() {
         let id = format!("{}@local", "p".repeat(length - 6));
         let selected_plugin = SelectedPluginIdentity {
             selected_root_id: Some("capability-root".to_string()),
-            plugin_id: id.clone(),
+            plugin_id: codex_core_plugins::PluginIdentity::Local {
+                plugin_id: id.clone(),
+            },
         };
         turn_context.active_host_plugin_identities = Some(Vec::new());
         let selected_plugins = SelectedPluginSnapshot {
@@ -154,7 +158,9 @@ async fn active_plugin_ids_enforce_bounds_after_selection_and_deduplication() {
             .iter()
             .map(|id| SelectedPluginIdentity {
                 selected_root_id: Some("capability-root".to_string()),
-                plugin_id: id.clone(),
+                plugin_id: codex_core_plugins::PluginIdentity::Local {
+                    plugin_id: id.clone(),
+                },
             })
             .collect::<Vec<_>>();
         turn_context.active_host_plugin_identities = Some(identities);

codex-rs/core/src/session/turn_context.rs

@@ -597,12 +597,25 @@ impl TurnContext {
         const MAX_TELEMETRY_PLUGIN_ID_BYTES: usize = 128;
 
         let mut identities = self.active_host_plugin_identities.clone()?;
-        // Selected roots provide a package key, not a remote identity for that object.
+        // Selected catalogs preserve local package keys or canonical remote identities.
         if let Some(selected) = selected {
-            identities.extend(selected.plugins.iter().map(|plugin| PluginIdentity {
-                plugin_id: plugin.plugin_id.clone(),
-                remote_plugin_id: None,
-            }));
+            identities.extend(
+                selected
+                    .plugins
+                    .iter()
+                    .map(|plugin| match &plugin.plugin_id {
+                        codex_core_plugins::PluginIdentity::Local { plugin_id } => PluginIdentity {
+                            plugin_id: plugin_id.clone(),
+                            remote_plugin_id: None,
+                        },
+                        codex_core_plugins::PluginIdentity::Remote { remote_plugin_id } => {
+                            PluginIdentity {
+                                plugin_id: String::new(),
+                                remote_plugin_id: Some(remote_plugin_id.clone()),
+                            }
+                        }
+                    }),
+            );
         }
         let mut ids = Vec::with_capacity(identities.len());
         for identity in identities {