Route curated plugin catalogs by authentication mode (#38429)

## Why

The model provider does not reliably identify which curated plugin catalog is
available. ChatGPT authentication can be used with a custom provider, while an
unauthenticated session should use the API-compatible catalog regardless of its
provider.

## What changed

- Select the ChatGPT curated catalog only for authentication modes that use the
  Codex backend; use the API curated catalog for API-key and unauthenticated
  sessions.
- Initialize standalone plugin managers with the current authentication mode
  across CLI, app-server, MCP, and external-agent migration paths.
- Preserve authentication mode while detecting and importing migrated plugins.

## Testing

- Cover catalog and skill routing across ChatGPT, API-key, unauthenticated,
  Bedrock, and custom-provider configurations.
- Verify authenticated plugin migration uses the ChatGPT curated marketplace.

GitOrigin-RevId: 660a339ee8891c33aad961078d3a979242a6a166

codex-rs/cli/src/marketplace_cmd.rs

@@ -211,8 +211,7 @@ async fn run_list(overrides: Vec<(String, toml::Value)>, args: ListMarketplaceAr
     let config = Config::load_with_cli_overrides(overrides)
         .await
         .context("failed to load configuration")?;
-    let manager = plugins_manager_for_config(&config);
-    manager.set_auth_mode(load_cli_auth_mode(&config).await?);
+    let manager = plugins_manager_for_config(&config, load_cli_auth_mode(&config).await?);
     let plugins_input = config.plugins_config_input();
     let marketplace_listing = manager
         .discover_marketplaces_for_config(&plugins_input, &[])
@@ -378,7 +377,7 @@ async fn run_upgrade(
     let config = Config::load_with_cli_overrides(overrides)
         .await
         .context("failed to load configuration")?;
-    let manager = plugins_manager_for_config(&config);
+    let manager = plugins_manager_for_config(&config, load_cli_auth_mode(&config).await?);
     let plugins_input = config.plugins_config_input();
     let outcome = manager
         .upgrade_configured_marketplaces_for_config(&plugins_input, marketplace_name.as_deref())

codex-rs/cli/src/mcp_cmd.rs

@@ -524,8 +524,10 @@ async fn run_remove(config_overrides: &CliConfigOverrides, remove_args: RemoveAr
 }
 
 async fn load_mcp_manager(config: &Config) -> Result<McpManager> {
-    let plugins_manager = Arc::new(plugins_manager_for_config(config));
-    plugins_manager.set_auth_mode(load_cli_auth_mode(config).await?);
+    let plugins_manager = Arc::new(plugins_manager_for_config(
+        config,
+        load_cli_auth_mode(config).await?,
+    ));
     Ok(McpManager::new(plugins_manager))
 }
 

codex-rs/cli/src/plugin_cmd.rs

@@ -590,8 +590,7 @@ async fn load_plugin_command_context(
         .await
         .context("failed to load configuration")?;
     let plugins_input = config.plugins_config_input();
-    let manager = plugins_manager_for_config(&config);
-    manager.set_auth_mode(load_cli_auth_mode(&config).await?);
+    let manager = plugins_manager_for_config(&config, load_cli_auth_mode(&config).await?);
     Ok(PluginCommandContext {
         codex_home: codex_home.to_path_buf(),
         plugins_input,