## Why
Background marketplace and plugin refreshes can otherwise inherit repository-local or command-scoped Git configuration from the project that launched Codex. That configuration can redirect remotes or invoke Git helpers during an automatic operation.
## What changed
- Run automatic marketplace upgrades, plugin cache refreshes, and curated marketplace lookups with repository-scoped Git environment variables removed and a temporary trusted repository under the Codex home.
- Carry the automatic/manual trust mode through marketplace upgrades and plugin materialization.
- Preserve the caller's Git configuration for explicit marketplace upgrades, plugin installs, and refreshes.
## Testing
- Add regression coverage for repository URL rewrites, protocol helpers, command-scoped configuration, and manual Git filters.
GitOrigin-RevId: 957f45fa3bd7ce7e1b83355f276cf65dc5e99c8e
ffad922340