Read plugin authentication state from AuthManager (#39087)

## What changed

- Give `PluginsManager` a shared `AuthManager` instead of a separately mutable authentication-mode snapshot.
- Read the current authentication mode and credentials from that shared manager for plugin discovery, startup tasks, CLI commands, MCP setup, and external-agent migration.
- Update test helpers and coverage to exercise plugin projections and curated marketplace selection as authentication changes.

GitOrigin-RevId: 600c94de5130eda2da5727e1a0b4d39083fefc56

codex-rs/core/src/plugins/mod.rs

@@ -11,7 +11,7 @@ pub(crate) mod test_support;
 
 use crate::config::Config;
 use codex_core_plugins::PluginsManager;
-use codex_protocol::auth::AuthMode;
+use codex_login::AuthManager;
 use codex_skills_extension::HostSkillsService;
 use std::sync::Arc;
 
@@ -29,14 +29,17 @@ pub(crate) use mentions::collect_tool_mentions_from_messages;
 /// Constructs a standalone plugin manager with extension-owned plugin skill loading.
 ///
 /// Callers that already own a host skills service should inject that existing service instead.
-pub fn plugins_manager_for_config(config: &Config, auth_mode: Option<AuthMode>) -> PluginsManager {
+pub fn plugins_manager_for_config(
+    config: &Config,
+    auth_manager: Arc<AuthManager>,
+) -> PluginsManager {
     let skill_root_loader = Arc::new(HostSkillsService::new(
         config.codex_home.clone(),
         /*bundled_skills_enabled*/ false,
     ));
     PluginsManager::new(
         config.codex_home.to_path_buf(),
-        auth_mode,
+        auth_manager,
         skill_root_loader,
     )
 }