Surface admin-disabled remote plugin status (#20298)

## Summary

Remote plugin-service returns plugin availability separately from a
user's installed/enabled state. This adds `PluginAvailabilityStatus` to
the app-server protocol, propagates remote catalog `status` into
`PluginSummary`, and rejects install attempts for remote plugins marked
`DISABLED_BY_ADMIN` before downloading or caching the bundle.

This is the `openai/codex` half of the change. The companion
`openai/openai` webview PR is
https://github.com/openai/openai/pull/873269.

## Validation

- `cargo run -p codex-app-server-protocol --bin write_schema_fixtures`
- `cargo test -p codex-app-server --test all
plugin_list_marks_remote_plugin_disabled_by_admin`
- `cargo test -p codex-app-server --test all
plugin_list_includes_remote_marketplaces_when_remote_plugin_enabled`
- `cargo test -p codex-app-server --test all
plugin_install_rejects_remote_plugin_disabled_by_admin_before_download`
- `cargo test -p codex-app-server-protocol schema_fixtures`

codex-rs/core-plugins/src/remote/share/tests.rs

@@ -381,6 +381,7 @@ async fn list_remote_plugin_shares_fetches_created_workspace_plugins() {
                 enabled: false,
                 install_policy: PluginInstallPolicy::Available,
                 auth_policy: PluginAuthPolicy::OnUse,
+                availability: PluginAvailability::Available,
                 interface: Some(expected_plugin_interface()),
             },
             RemotePluginSummary {
@@ -390,6 +391,7 @@ async fn list_remote_plugin_shares_fetches_created_workspace_plugins() {
                 enabled: true,
                 install_policy: PluginInstallPolicy::Available,
                 auth_policy: PluginAuthPolicy::OnUse,
+                availability: PluginAvailability::Available,
                 interface: Some(expected_plugin_interface()),
             }
         ]