[codex] Clarify plugin load and runtime capability stages (#28472)

## Summary

Plugin loading and auth projection both previously produced
`PluginLoadOutcome`. That made an unfiltered load result look like
runtime-ready capabilities and generated capability summaries before
auth routing had run.

This change keeps loaded plugin records in the cache, applies the
current auth policy in `PluginsManager`, and only then builds
`PluginLoadOutcome` and its summaries. Auth changes still reuse the
cached disk load and re-resolve apps and MCP servers without reloading
plugins.

The updated tests cover cached auth changes and verify that capability
summaries match the effective app/MCP surface.

## Testing

- `just test -p codex-core-plugins`
- `just test -p codex-plugin`
- `just fix -p codex-core-plugins`

codex-rs/core-plugins/src/loader_tests.rs

@@ -173,9 +173,8 @@ enabled = true
     )
     .await;
 
-    let validation_state = |outcome: &PluginLoadOutcome<McpServerConfig>| {
-        outcome
-            .plugins()
+    let validation_state = |plugins: &[LoadedPlugin<McpServerConfig>]| {
+        plugins
             .iter()
             .map(|plugin| {
                 (
@@ -183,22 +182,15 @@ enabled = true
                     plugin.enabled,
                     plugin.root.clone(),
                     plugin.error.clone(),
+                    plugin.hook_sources.clone(),
+                    plugin.hook_load_warnings.clone(),
                 )
             })
             .collect::<Vec<_>>()
     };
     assert_eq!(validation_state(&hooks_only), validation_state(&full));
-    assert_eq!(
-        hooks_only.effective_plugin_hook_sources(),
-        full.effective_plugin_hook_sources()
-    );
-    assert_eq!(
-        hooks_only.effective_plugin_hook_warnings(),
-        full.effective_plugin_hook_warnings()
-    );
 
     let full_valid = full
-        .plugins()
         .iter()
         .find(|plugin| plugin.config_name == "valid@test")
         .expect("full load should include valid plugin");
@@ -208,7 +200,6 @@ enabled = true
     assert!(!full_valid.apps.is_empty());
 
     let hooks_only_valid = hooks_only
-        .plugins()
         .iter()
         .find(|plugin| plugin.config_name == "valid@test")
         .expect("hooks-only load should include valid plugin");