feat: Cache remote plugin bundles on install (#19914)

Remote installs now fetch, validate, download, and cache the plugin
bundle locally

codex-rs/Cargo.lock

@@ -1880,6 +1880,7 @@ dependencies = [
  "codex-utils-rustls-provider",
  "constant_time_eq 0.3.1",
  "core_test_support",
+ "flate2",
  "futures",
  "gethostname",
  "hmac",
@@ -1895,6 +1896,7 @@ dependencies = [
  "serial_test",
  "sha2",
  "shlex",
+ "tar",
  "tempfile",
  "thiserror 2.0.18",
  "time",
@@ -2479,11 +2481,13 @@ dependencies = [
  "codex-utils-absolute-path",
  "codex-utils-plugins",
  "dirs",
+ "flate2",
  "libc",
  "pretty_assertions",
  "reqwest",
  "serde",
  "serde_json",
+ "tar",
  "tempfile",
  "thiserror 2.0.18",
  "tokio",
@@ -12278,6 +12282,16 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7b2093cf4c8eb1e67749a6762251bc9cd836b6fc171623bd0a9d324d37af2417"
 
+[[package]]
+name = "tar"
+version = "0.4.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22692a6476a21fa75fdfc11d452fda482af402c008cdbaf3476414e122040973"
+dependencies = [
+ "filetime",
+ "libc",
+]
+
 [[package]]
 name = "target-lexicon"
 version = "0.13.3"