Expose plugin installation interstitial requirements (#33896)

## What changed

- Add nullable `mustShowInstallationInterstitial` metadata to app-server
  `PluginSummary` responses.
- Preserve the remote service value through catalog, installed-plugin cache,
  list, read, and share-list paths.
- Return `null` for local plugins and remote responses that omit the field so
  clients can fail closed when the policy is unavailable.

## Testing

- Cover `true`, `false`, and missing values across remote summary paths and
  app-server plugin endpoints.

GitOrigin-RevId: db79702ee2bfa800a9910d64d933bcabecb3ce70

codex-rs/tui/src/chatwidget/tests/helpers.rs

@@ -1342,6 +1342,7 @@ pub(super) fn plugins_test_summary(
         enabled,
         install_policy,
         install_policy_source: None,
+        must_show_installation_interstitial: None,
         auth_policy: PluginAuthPolicy::OnInstall,
         availability: PluginAvailability::Available,
         interface: Some(plugins_test_interface(
@@ -1372,6 +1373,7 @@ pub(super) fn plugins_test_remote_summary(
         enabled: true,
         install_policy: PluginInstallPolicy::Available,
         install_policy_source: None,
+        must_show_installation_interstitial: None,
         auth_policy: PluginAuthPolicy::OnInstall,
         availability: PluginAvailability::Available,
         interface: Some(plugins_test_interface(