Surface admin-disabled remote plugin status (#20298)

## Summary

Remote plugin-service returns plugin availability separately from a
user's installed/enabled state. This adds `PluginAvailabilityStatus` to
the app-server protocol, propagates remote catalog `status` into
`PluginSummary`, and rejects install attempts for remote plugins marked
`DISABLED_BY_ADMIN` before downloading or caching the bundle.

This is the `openai/codex` half of the change. The companion
`openai/openai` webview PR is
https://github.com/openai/openai/pull/873269.

## Validation

- `cargo run -p codex-app-server-protocol --bin write_schema_fixtures`
- `cargo test -p codex-app-server --test all
plugin_list_marks_remote_plugin_disabled_by_admin`
- `cargo test -p codex-app-server --test all
plugin_list_includes_remote_marketplaces_when_remote_plugin_enabled`
- `cargo test -p codex-app-server --test all
plugin_install_rejects_remote_plugin_disabled_by_admin_before_download`
- `cargo test -p codex-app-server-protocol schema_fixtures`

codex-rs/core-plugins/src/remote.rs

@@ -1,6 +1,7 @@
 use crate::store::PLUGINS_CACHE_DIR;
 use crate::store::PluginStore;
 use codex_app_server_protocol::PluginAuthPolicy;
+use codex_app_server_protocol::PluginAvailability;
 use codex_app_server_protocol::PluginInstallPolicy;
 use codex_app_server_protocol::PluginInterface;
 use codex_app_server_protocol::SkillInterface;
@@ -67,6 +68,7 @@ pub struct RemotePluginSummary {
     pub enabled: bool,
     pub install_policy: PluginInstallPolicy,
     pub auth_policy: PluginAuthPolicy,
+    pub availability: PluginAvailability,
     pub interface: Option<PluginInterface>,
 }
 
@@ -265,6 +267,8 @@ struct RemotePluginDirectoryItem {
     scope: RemotePluginScope,
     installation_policy: PluginInstallPolicy,
     authentication_policy: PluginAuthPolicy,
+    #[serde(rename = "status", default)]
+    availability: PluginAvailability,
     release: RemotePluginReleaseResponse,
 }
 
@@ -661,6 +665,7 @@ fn build_remote_plugin_summary(
         enabled: installed_plugin.is_some_and(|plugin| plugin.enabled),
         install_policy: plugin.installation_policy,
         auth_policy: plugin.authentication_policy,
+        availability: plugin.availability,
         interface: remote_plugin_interface_to_info(plugin),
     }
 }

codex-rs/core-plugins/src/remote/share/tests.rs

@@ -381,6 +381,7 @@ async fn list_remote_plugin_shares_fetches_created_workspace_plugins() {
                 enabled: false,
                 install_policy: PluginInstallPolicy::Available,
                 auth_policy: PluginAuthPolicy::OnUse,
+                availability: PluginAvailability::Available,
                 interface: Some(expected_plugin_interface()),
             },
             RemotePluginSummary {
@@ -390,6 +391,7 @@ async fn list_remote_plugin_shares_fetches_created_workspace_plugins() {
                 enabled: true,
                 install_policy: PluginInstallPolicy::Available,
                 auth_policy: PluginAuthPolicy::OnUse,
+                availability: PluginAvailability::Available,
                 interface: Some(expected_plugin_interface()),
             }
         ]