Respect system proxies during plugin startup sync (#34506)

## Why

The curated plugin startup sync can fall back from Git to HTTP, but those
requests did not use Codex's effective outbound proxy policy.

## What changed

- Thread the configured HTTP client factory into curated plugin sync.
- Route GitHub API, zipball, backup metadata, and returned download URLs
  through the route-aware client when system proxy support is enabled.
- Preserve the existing default HTTP client behavior, including its custom CA
  fallback, when system proxy support is disabled.
- Apply the standard Codex headers to startup-sync HTTP requests.

## Testing

Add coverage that records route selection for repository, archive, metadata,
and backend-supplied download URLs, and verifies standard headers are sent.

GitOrigin-RevId: e1ea13bdab58a84c9948a2c8b82a5ec5c964ea99

codex-rs/core/src/config/mod.rs

@@ -1535,6 +1535,7 @@ impl Config {
             self.features.enabled(Feature::Plugins),
             self.features.enabled(Feature::RemotePlugin),
             self.chatgpt_base_url.clone(),
+            self.http_client_factory(),
         )
     }
 

codex-rs/core/src/plugins/discoverable_tests.rs

@@ -221,9 +221,10 @@ plugins = true
     let plugins_manager = PluginsManager::new(config.codex_home.to_path_buf());
     fetch_and_cache_global_remote_plugin_catalog(
         codex_home.path(),
-        &RemotePluginServiceConfig {
-            chatgpt_base_url: config.chatgpt_base_url.clone(),
-        },
+        &RemotePluginServiceConfig::new(
+            config.chatgpt_base_url.clone(),
+            config.http_client_factory(),
+        ),
         Some(&auth),
     )
     .await