Collect plugin metrics from remote executors (#38283)

## What changed

- Resolve manifest-declared metric operations against the executor filesystem for remote plugin commands.
- Create the measurement sidecar in an executor-native, owner-private temporary directory, stream its bounded output back for validation, and clean up the directory afterward.
- Extend the exec-server protocol with the executor temporary directory and atomic private-directory creation.

## Testing

- Cover remote unified-exec measurements for foreground and background commands.
- Verify private directories use owner-only permissions on Unix and fail closed on unsupported platforms.

GitOrigin-RevId: dbbd0a84717b91237fc5728e510e18994eb46dd4

codex-rs/core/src/session/turn_context.rs

@@ -243,14 +243,24 @@ impl TurnContext {
         }
     }
 
-    pub(crate) fn plugin_metrics_operation_for_command(
+    pub(crate) async fn plugin_metrics_operation_for_command(
         &self,
         command: &[String],
-        cwd: &AbsolutePathBuf,
+        cwd: &PathUri,
+        environment: &Environment,
     ) -> Option<ResolvedPluginMetricsOperation> {
-        self.extension_data
-            .get::<TrustedPluginRoots>()?
-            .resolve_metrics_operation(command, cwd)
+        let trusted_roots = self.extension_data.get::<TrustedPluginRoots>()?;
+        if environment.is_remote() {
+            trusted_roots
+                .resolve_metrics_operation_in_filesystem(
+                    command,
+                    cwd,
+                    environment.get_filesystem().as_ref(),
+                )
+                .await
+        } else {
+            trusted_roots.resolve_metrics_operation(command, &cwd.to_abs_path().ok()?)
+        }
     }
 
     pub(crate) fn permission_profile(&self) -> PermissionProfile {