[codex] Load API curated marketplace by auth (#28383)

## Summary
- choose the local OpenAI curated marketplace manifest based on auth:
Codex backend auth gets the existing marketplace, direct provider auth
gets `api_marketplace.json`
- include Bedrock API key auth in the direct-provider API marketplace
path
- safely skip the API marketplace when `api_marketplace.json` is absent

## Validation
- `just fmt`
- `git diff --check origin/main...HEAD`
- CI should run the full validation

## Manual Testing

### - New api marketplace not available for API key sign
1. Safely not display anything from api marketplace
<img width="1161" height="289" alt="Screenshot 2026-06-15 at 21 37 43"
src="https://github.com/user-attachments/assets/a5f16642-8a20-4ac1-a0de-1274a4c7b5b2"
/>

### - New api marketplace for API key sign in
1. Setup api_marketplace.json
```
{
  "name": "openai-curated",
  "interface": {
    "displayName": "Codex official"
  },
  "plugins": [
    {
      "name": "linear",
      "source": {
        "source": "local",
        "path": "./plugins/linear"
      },
      "policy": {
        "installation": "AVAILABLE",
        "authentication": "ON_INSTALL"
      },
      "category": "Productivity"
    }
  ]
}
```

2. Log in with API key, observe that only the defined plugin from
api_marketplace.json is available from "Codex Official" (outside of
local testing marketplaces)
<img width="1167" height="446" alt="Screenshot 2026-06-15 at 21 16 53"
src="https://github.com/user-attachments/assets/7cf61477-d826-4ef6-bc05-0a23ac1c0259"
/>

also checked functionality on codex app

### - SiWC users 
Still uses 'default' marketplace.json and renders all plugins
<img width="1171" height="502" alt="Screenshot 2026-06-15 at 21 40 25"
src="https://github.com/user-attachments/assets/d212ea9b-0aa5-470b-8ea4-450efe65bb2b"
/>

also checked functionality on codex app


## Notes
- `just test -p codex-core-plugins` was started locally before splitting
branches, but I stopped relying on local tests per follow-up and left
final validation to PR CI.

codex-rs/core-plugins/src/discoverable.rs

@@ -3,9 +3,12 @@ use codex_app_server_protocol::PluginAvailability;
 use codex_app_server_protocol::PluginInstallPolicy;
 use codex_login::CodexAuth;
 use codex_plugin::PluginCapabilitySummary;
+use codex_plugin::PluginId;
 use std::collections::HashSet;
 use tracing::warn;
 
+use crate::OPENAI_API_CURATED_MARKETPLACE_NAME;
+use crate::OPENAI_CURATED_MARKETPLACE_NAME;
 use crate::PluginsConfigInput;
 use crate::PluginsManager;
 use crate::marketplace::MarketplacePluginInstallPolicy;
@@ -74,11 +77,7 @@ impl PluginsManager {
         }
 
         let marketplaces = self
-            .list_marketplaces_for_config(
-                &input.plugins,
-                &[],
-                /*include_openai_curated*/ !input.plugins.remote_plugin_enabled,
-            )
+            .list_marketplaces_for_config(&input.plugins, &[], /*include_openai_curated*/ true)
             .context("failed to list plugin marketplaces for tool suggestions")?
             .marketplaces;
         let remote_installed_marketplaces = if input.plugins.remote_plugin_enabled {
@@ -95,8 +94,7 @@ impl PluginsManager {
 
             for plugin in marketplace.plugins {
                 let is_configured_plugin = input.configured_plugin_ids.contains(plugin.id.as_str());
-                let is_fallback_plugin =
-                    TOOL_SUGGEST_DISCOVERABLE_PLUGIN_ALLOWLIST.contains(&plugin.id.as_str());
+                let is_fallback_plugin = is_tool_suggest_fallback_plugin(&plugin.id);
                 if plugin.installed
                     || plugin.policy.installation == MarketplacePluginInstallPolicy::NotAvailable
                     || input.disabled_plugin_ids.contains(plugin.id.as_str())
@@ -162,8 +160,7 @@ impl PluginsManager {
                     || input
                         .configured_plugin_ids
                         .contains(plugin.remote_plugin_id.as_str());
-                let is_fallback_plugin =
-                    TOOL_SUGGEST_DISCOVERABLE_PLUGIN_ALLOWLIST.contains(&plugin.config_id.as_str());
+                let is_fallback_plugin = is_tool_suggest_fallback_plugin(&plugin.config_id);
                 let matches_installed_app = plugin
                     .app_ids
                     .iter()
@@ -203,6 +200,25 @@ impl PluginsManager {
     }
 }
 
+fn is_tool_suggest_fallback_plugin(plugin_id: &str) -> bool {
+    if TOOL_SUGGEST_DISCOVERABLE_PLUGIN_ALLOWLIST.contains(&plugin_id) {
+        return true;
+    }
+
+    let Ok(plugin_id) = PluginId::parse(plugin_id) else {
+        return false;
+    };
+    if plugin_id.marketplace_name != OPENAI_API_CURATED_MARKETPLACE_NAME {
+        return false;
+    }
+
+    let default_curated_plugin_id = format!(
+        "{}@{}",
+        plugin_id.plugin_name, OPENAI_CURATED_MARKETPLACE_NAME
+    );
+    TOOL_SUGGEST_DISCOVERABLE_PLUGIN_ALLOWLIST.contains(&default_curated_plugin_id.as_str())
+}
+
 #[cfg(test)]
 #[path = "discoverable_tests.rs"]
 mod tests;