[codex] Limit app-based plugin suggestions to remote catalogs

[xl-openai]

Summary

• Keep local plugin suggestions bounded to fallback and explicitly configured plugins.
• Preserve app-overlap recommendations for remote plugins using cached catalog metadata.
• Remove the WSL-specific local discovery exception and move manager-owned discovery tests into codex-core-plugins.

Why

Local curated marketplaces were allowlisted before plugin detail loading, so every uninstalled candidate could be deep-read before its app IDs were checked. That caused per-turn reads of candidate plugin manifests, skills, app configs, hooks, and MCP configs, which is especially expensive on slow disks.

Remote discovery does not need those local candidate reads because app IDs are already available in the cached remote catalog. Installed local plugins are still loaded when needed to determine the user's installed app IDs.

Validation

• just fmt
• just test -p codex-core-plugins discoverable::tests (13 passed)
• just test -p codex-core plugins::discoverable::tests (4 passed)
• just bazel-lock-update
• just bazel-lock-check
• git diff --check

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 13b29654fb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".