## Why
Hosts need to refresh cloud plugin and skill catalogs without starting a turn or waiting for step preparation.
## What changed
- Add `CodexThread::refresh_cloud_plugins()` and a turn-independent extension callback that bypass cached catalog reuse and failure cooldowns.
- Run catalog contributors concurrently while serializing publication with step snapshot capture. Invalidate MCP resource caches before explicit discovery and schedule MCP reconciliation afterward.
- Accept complete and partial catalogs, report discovery errors, and keep failed or cancelled refreshes retryable.
- Allow hosts to gate cloud plugin discovery through effective configuration.
## Testing
Add coverage for discovery before turn admission, catalog replacement and reuse, immediate retry after failure, concurrent contributors, and cancellation-safe publication and invalidation.
GitOrigin-RevId: 83e847fcab6562581af2c9e831b1d2a310f2b270
Anthony Tafoya
d26406987e