[codex] cache remote plugin marketplaces during startup

[xli-oai]

Summary

• add a short-lived app-server cache for remote marketplace listings
• reuse startup plugin work to prewarm the global remote marketplace catalog
• coalesce overlapping startup and foreground fetches so only one backend request runs for the same cache key

Why

plugin/list currently fetches remote marketplace data on demand, so the first @ lookup or Plugins page open can still pay remote catalog latency even though startup is already doing related remote-plugin work. There is also a startup race where a foreground request can overlap the warmup and trigger the same remote fetch again.

What changed

• cache remote marketplace responses for 5 minutes, keyed by auth identity, base URL, and requested remote sources
• route app-server plugin/list through the shared cache path
• prewarm the global remote catalog from the existing startup remote-plugin task
• clear the cache on direct remote install/uninstall mutations
• add in-flight request sharing so concurrent callers join the same fetch instead of duplicating it

Validation

• cargo test -p codex-core-plugins
• cargo test -p codex-app-server plugin_list_includes_remote_marketplaces_when_remote_plugin_enabled -- --nocapture
• just fmt
• just fix -p codex-core-plugins
• just fix -p codex-app-server

Notes

• cargo test -p codex-app-server still has unrelated local-environment failures in existing sandboxed command-exec tests (sandbox-exec: sandbox_apply: Operation not permitted) plus unrelated timing-sensitive tests. The touched remote-plugin path passed its focused coverage.