test: harden app-server integration tests (#19683)

## Why

Windows Bazel runs in the permissions stack exposed that app-server
integration tests were launching normal plugin startup warmups in every
subprocess. Those warmups can call
`https://chatgpt.com/backend-api/plugins/featured` when a test is not
specifically exercising plugin startup, which adds slow background work,
noisy stderr, and dependence on external network state. The relevant
startup/featured-plugin behavior was introduced across #15042 and
#15264.

A few app-server tests also had long optional waits or unbounded cleanup
paths, making failures expensive to diagnose and contributing to slow
Windows shards. One external-agent config test from #18246 used a
GitHub-style marketplace source, which was enough to exercise the
pending remote-import path but also meant the background completion task
could attempt a real clone.

## What Changed

- Adds explicit `AppServerRuntimeOptions` / `PluginStartupTasks`
plumbing and a hidden debug-only
`--disable-plugin-startup-tasks-for-tests` app-server flag, so
integration tests can suppress startup plugin warmups without adding a
production env-var gate.
- Has the app-server test harness pass that hidden flag by default,
while opting plugin-startup coverage back in for tests that
intentionally exercise startup sync and featured-plugin warmup behavior.
- Lowers normal app-server subprocess logging from `info`/`debug` to
`warn` to avoid multi-megabyte stderr output in Bazel logs.
- Prevents the external-agent config test from attempting a real
marketplace clone by using an invalid non-local source while still
exercising the pending-import completion path.
- Bounds optional filesystem/realtime waits and fake WebSocket
test-server shutdown so failures produce targeted timeouts instead of
hanging a shard.
- Fixes the Unix script-resolution test in `rmcp-client` to exercise
PATH resolution directly and include the actual spawn error in failures.

## Verification

- `cargo check -p codex-app-server`
- `cargo clippy -p codex-app-server --tests -- -D warnings`
- `cargo test -p codex-rmcp-client
program_resolver::tests::test_unix_executes_script_without_extension`
- `cargo test -p codex-app-server --test all
external_agent_config_import_sends_completion_notification_after_pending_plugins_finish
-- --nocapture`
- `cargo test -p codex-app-server --test all
plugin_list_uses_warmed_featured_plugin_ids_cache_on_first_request --
--nocapture`
- Windows Local Bazel passed with this test-hardening bundle before it
was extracted from #19606.

---
[//]: # (BEGIN SAPLING FOOTER)
Stack created with [Sapling](https://sapling-scm.com). Best reviewed
with [ReviewStack](https://reviewstack.dev/openai/codex/pull/19683).
* #19395
* #19394
* #19393
* #19392
* #19606
* __->__ #19683

codex-rs/rmcp-client/src/program_resolver.rs

@@ -75,11 +75,14 @@ mod tests {
     #[tokio::test]
     async fn test_unix_executes_script_without_extension() -> Result<()> {
         let env = TestExecutableEnv::new()?;
-        let mut cmd = Command::new(&env.executable_path);
+        let mut cmd = Command::new(&env.program_name);
         cmd.envs(&env.mcp_env);
 
         let output = cmd.output().await;
-        assert!(output.is_ok(), "Unix should execute scripts directly");
+        assert!(
+            output.is_ok(),
+            "Unix should execute PATH-resolved scripts directly: {output:?}"
+        );
         Ok(())
     }
 
@@ -143,8 +146,6 @@ mod tests {
         // Held to prevent the temporary directory from being deleted.
         _temp_dir: TempDir,
         program_name: String,
-        #[cfg(unix)]
-        executable_path: std::path::PathBuf,
         mcp_env: HashMap<OsString, OsString>,
     }
 
@@ -167,8 +168,6 @@ mod tests {
             let mcp_env = create_env_for_mcp_server(Some(extra_env), &[])?;
 
             Ok(Self {
-                #[cfg(unix)]
-                executable_path: Self::executable_path(dir_path),
                 _temp_dir: temp_dir,
                 program_name: Self::TEST_PROGRAM.to_string(),
                 mcp_env,
@@ -193,11 +192,6 @@ mod tests {
             Ok(())
         }
 
-        #[cfg(unix)]
-        fn executable_path(dir: &Path) -> std::path::PathBuf {
-            dir.join(Self::TEST_PROGRAM)
-        }
-
         #[cfg(unix)]
         fn set_executable(path: &Path) -> Result<()> {
             use std::os::unix::fs::PermissionsExt;