[codex] Support npm marketplace plugin sources

[charlesgong-openai]

Why

Marketplace source deserialization treated {"source":"npm",...} as unsupported. The loader logged and skipped the entry, so npm-backed plugins never appeared in plugin list --available and plugin add returned “plugin not found”.

The initial npm materialization path also needed a stricter supply-chain boundary: npm package specs can refer to local directories, tarball URLs, Git URLs, or aliases, and npm install resolves an unnecessary dependency graph for plugin packages.

What changed

• Add npm marketplace plugin sources with package, an exact semver version, optional HTTPS registry, and required sha512 integrity.
• Reject non-semver version selectors, plaintext or credential-bearing registry URLs, registry query/fragment data, and malformed integrity values before materialization.
• Fetch npm plugins with npm pack --ignore-scripts instead of npm install, so Codex fetches only the requested package tarball rather than its dependency graph.
• Verify the tarball against the declared integrity digest, enforce archive and extracted-size limits, reject traversal/link archive entries through the existing hardened extractor, and verify the extracted package.json name/version before installing.
• Keep the existing plugin manifest/name validation, versioned cache installation, installed-source detail behavior, CLI output, app-server v2 PluginSource, regenerated schema fixtures, and app-server documentation in sync.

Impact

Marketplaces can distribute Codex plugins from public or configured private HTTPS npm registries while pinning the exact artifact that Codex installs. Marketplace authors must provide an exact version and the package tarball's sha512 integrity value.

Fixes #27831

Validation

• just write-app-server-schema
• just test -p codex-app-server-protocol (245 passed)
• just test -p codex-cli (288 passed)
• just test -p codex-core-plugins (265 passed; one unrelated existing failure from home fixture skills contaminating skills_service_reuses_skills_parsed_during_plugin_load)
• just bazel-lock-check