Sync remote installed plugin bundles (#20268)

## Summary
- Download missing remote installed plugin bundles during app-server
startup and plugin/list refresh.
- Upgrade cached remote installed bundles when the backend installed
version changes.
- Remove stale remote installed bundle caches without writing remote
plugin state into config.toml.

## Review note
This is a clean PR branch cut from the current diff on top of latest
`origin/main`. The diff intentionally has no `codex-rs/core/**` files,
so CODEOWNERS should not request the core-directory owner review from
stale PR history.

## Validation
Already run on the source branch before creating this clean PR:
- `just fmt`
- `cargo test -p codex-core-plugins`
- `cargo test -p codex-app-server --test all
app_server_startup_sync_downloads_remote_installed_plugin_bundles --
--nocapture`
- `cargo test -p codex-app-server --test all
plugin_list_sync_upgrades_and_removes_remote_installed_plugin_bundles --
--nocapture`
- `cargo test -p codex-app-server --test all
app_server_startup_remote_plugin_sync_runs_once -- --nocapture`
- `just fix -p codex-core-plugins`
- `just fix -p codex-app-server`
- `git diff --check`

codex-rs/core-plugins/src/manager.rs

@@ -668,6 +668,35 @@ impl PluginsManager {
         );
     }
 
+    fn maybe_start_remote_installed_plugin_bundle_sync(
+        self: &Arc<Self>,
+        config: &PluginsConfigInput,
+        auth: Option<CodexAuth>,
+        on_effective_plugins_changed: Option<Arc<dyn Fn() + Send + Sync + 'static>>,
+    ) {
+        if !config.plugins_enabled || !config.remote_plugin_enabled {
+            return;
+        }
+
+        let manager = Arc::clone(self);
+        let config_for_refresh = config.clone();
+        let auth_for_refresh = auth.clone();
+        let on_local_cache_changed = Arc::new(move || {
+            manager.maybe_start_remote_installed_plugins_cache_refresh_after_mutation(
+                &config_for_refresh,
+                auth_for_refresh.clone(),
+                on_effective_plugins_changed.clone(),
+            );
+        });
+
+        crate::remote::maybe_start_remote_installed_plugin_bundle_sync(
+            self.codex_home.clone(),
+            remote_plugin_service_config(config),
+            auth,
+            Some(on_local_cache_changed),
+        );
+    }
+
     pub fn maybe_start_plugin_list_background_tasks_for_config(
         self: &Arc<Self>,
         config: &PluginsConfigInput,
@@ -677,6 +706,11 @@ impl PluginsManager {
     ) {
         self.maybe_start_non_curated_plugin_cache_refresh(roots);
         self.maybe_start_remote_installed_plugins_cache_refresh(
+            config,
+            auth.clone(),
+            on_effective_plugins_changed.clone(),
+        );
+        self.maybe_start_remote_installed_plugin_bundle_sync(
             config,
             auth,
             on_effective_plugins_changed,
@@ -1413,6 +1447,11 @@ impl PluginsManager {
                 tokio::spawn(async move {
                     let auth = auth_manager.auth().await;
                     manager.maybe_start_remote_installed_plugins_cache_refresh(
+                        &config,
+                        auth.clone(),
+                        on_effective_plugins_changed.clone(),
+                    );
+                    manager.maybe_start_remote_installed_plugin_bundle_sync(
                         &config,
                         auth,
                         on_effective_plugins_changed,