Attribute executor skill invocations to plugins (#39309)

## What changed

- Carry selected plugin identities from MCP discovery into per-turn extension data, limited to capability roots that are ready for the turn.
- Annotate executor skill catalog entries with the matching plugin ID and `user` scope.
- Include that attribution in `skill_invocation` analytics for both explicit and implicit executor skill invocations.

## Testing

- Extend the executor skills app-server test to verify plugin ID, skill scope, and invocation type for explicit and implicit analytics events.

GitOrigin-RevId: 9345600ae29bcb8eb894fffd2d6f7b05f22ebf74

codex-rs/app-server/tests/suite/v2/executor_skills.rs

@@ -28,6 +28,9 @@ use serde_json::json;
 use tempfile::TempDir;
 use tokio::time::timeout;
 
+use super::analytics::mount_analytics_capture;
+use super::analytics::wait_for_matching_analytics_event;
+
 #[cfg(target_os = "macos")]
 const READ_TIMEOUT: Duration = Duration::from_secs(60);
 #[cfg(not(target_os = "macos"))]
@@ -109,11 +112,17 @@ async fn exercise_executor_skill(scenario: ExecutorSkillScenario) -> Result<()>
         } else {
             ("never", "")
         };
+    let analytics_config = if scenario == ExecutorSkillScenario::ExplicitOnly {
+        format!("chatgpt_base_url = \"{}\"", server.uri())
+    } else {
+        String::new()
+    };
     std::fs::write(
         codex_home.path().join("config.toml"),
         format!(
             r#"
 model = "mock-model"
+{analytics_config}
 approval_policy = "{approval_policy}"
 {sandbox_config}
 model_provider = "mock_provider"
@@ -133,6 +142,9 @@ stream_max_retries = 0
             server.uri()
         ),
     )?;
+    if scenario == ExecutorSkillScenario::ExplicitOnly {
+        mount_analytics_capture(&server, codex_home.path()).await?;
+    }
     let local_skill_dir = codex_home.path().join("skills/local-deploy");
     std::fs::create_dir_all(&local_skill_dir)?;
     std::fs::write(
@@ -439,6 +451,17 @@ stream_max_retries = 0
         app_server.read_stream_until_notification_message("turn/completed"),
     )
     .await??;
+    if scenario == ExecutorSkillScenario::ExplicitOnly {
+        for invocation_type in ["explicit", "implicit"] {
+            let event = wait_for_matching_analytics_event(&server, READ_TIMEOUT, |event| {
+                event["event_type"] == "skill_invocation"
+                    && event["event_params"]["invoke_type"] == invocation_type
+            })
+            .await?;
+            assert_eq!(event["event_params"]["plugin_id"], authority_id);
+            assert_eq!(event["event_params"]["skill_scope"], "user");
+        }
+    }
 
     let requests = response_mock.requests();
     let request = &requests[0];