[codex] Load API curated marketplace by auth (#28383)

## Summary
- choose the local OpenAI curated marketplace manifest based on auth:
Codex backend auth gets the existing marketplace, direct provider auth
gets `api_marketplace.json`
- include Bedrock API key auth in the direct-provider API marketplace
path
- safely skip the API marketplace when `api_marketplace.json` is absent

## Validation
- `just fmt`
- `git diff --check origin/main...HEAD`
- CI should run the full validation

## Manual Testing

### - New api marketplace not available for API key sign
1. Safely not display anything from api marketplace
<img width="1161" height="289" alt="Screenshot 2026-06-15 at 21 37 43"
src="https://github.com/user-attachments/assets/a5f16642-8a20-4ac1-a0de-1274a4c7b5b2"
/>

### - New api marketplace for API key sign in
1. Setup api_marketplace.json
```
{
  "name": "openai-curated",
  "interface": {
    "displayName": "Codex official"
  },
  "plugins": [
    {
      "name": "linear",
      "source": {
        "source": "local",
        "path": "./plugins/linear"
      },
      "policy": {
        "installation": "AVAILABLE",
        "authentication": "ON_INSTALL"
      },
      "category": "Productivity"
    }
  ]
}
```

2. Log in with API key, observe that only the defined plugin from
api_marketplace.json is available from "Codex Official" (outside of
local testing marketplaces)
<img width="1167" height="446" alt="Screenshot 2026-06-15 at 21 16 53"
src="https://github.com/user-attachments/assets/7cf61477-d826-4ef6-bc05-0a23ac1c0259"
/>

also checked functionality on codex app

### - SiWC users 
Still uses 'default' marketplace.json and renders all plugins
<img width="1171" height="502" alt="Screenshot 2026-06-15 at 21 40 25"
src="https://github.com/user-attachments/assets/d212ea9b-0aa5-470b-8ea4-450efe65bb2b"
/>

also checked functionality on codex app


## Notes
- `just test -p codex-core-plugins` was started locally before splitting
branches, but I stopped relying on local tests per follow-up and left
final validation to PR CI.

codex-rs/core-plugins/src/marketplace.rs

@@ -9,7 +9,6 @@ use codex_protocol::protocol::Product;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use serde::Deserialize;
 use serde_json::Value as JsonValue;
-use std::collections::HashSet;
 use std::fs;
 use std::io;
 use std::path::Component;
@@ -19,6 +18,7 @@ use tracing::warn;
 
 const MARKETPLACE_MANIFEST_RELATIVE_PATHS: &[&str] = &[
     ".agents/plugins/marketplace.json",
+    ".agents/plugins/api_marketplace.json",
     ".claude-plugin/marketplace.json",
 ];
 
@@ -258,6 +258,19 @@ pub fn find_marketplace_manifest_path(root: &Path) -> Option<AbsolutePathBuf> {
         })
 }
 
+fn supported_marketplace_manifest_path(path: &Path) -> Option<AbsolutePathBuf> {
+    if !path.is_file() {
+        return None;
+    }
+    if !MARKETPLACE_MANIFEST_RELATIVE_PATHS
+        .iter()
+        .any(|relative_path| marketplace_root_from_layout(path, relative_path).is_some())
+    {
+        return None;
+    }
+    AbsolutePathBuf::try_from(path.to_path_buf()).ok()
+}
+
 fn invalid_marketplace_layout_error(path: &AbsolutePathBuf) -> MarketplaceError {
     MarketplaceError::InvalidMarketplaceFile {
         path: path.to_path_buf(),
@@ -327,16 +340,6 @@ pub fn load_marketplace(path: &AbsolutePathBuf) -> Result<Marketplace, Marketpla
     })
 }
 
-pub(crate) fn load_raw_marketplace_plugin_names(
-    path: &AbsolutePathBuf,
-) -> Result<HashSet<String>, MarketplaceError> {
-    Ok(load_raw_marketplace_manifest(path)?
-        .plugins
-        .into_iter()
-        .map(|plugin| plugin.name)
-        .collect())
-}
-
 #[doc(hidden)]
 pub fn list_marketplaces_with_home(
     additional_roots: &[AbsolutePathBuf],
@@ -377,6 +380,12 @@ fn discover_marketplace_paths_from_roots(
     }
 
     for root in additional_roots {
+        if let Some(path) = supported_marketplace_manifest_path(root.as_path())
+            && !paths.contains(&path)
+        {
+            paths.push(path);
+            continue;
+        }
         // Curated marketplaces can now come from an HTTP-downloaded directory that is not a git
         // checkout, so check the root directly before falling back to repo-root discovery.
         if let Some(path) = find_marketplace_manifest_path(root.as_path())