fix: prune stale Codex plugin version directories on install

[camjac251]

Summary

plugin install removed only the version directory it was about to write, leaving any sibling from an earlier install in place. Codex resolves the active plugin by scanning that directory and taking the highest version it finds, so a directory left behind by a newer install keeps being served after a downgrade.

Install 0.5.0, downgrade to 0.4.3, and Codex still loads 0.5.0.

Install now prunes stale sibling version directories, which is what Codex's own installer does after it stages a new version.

Evidence

codex-rs/core-plugins/src/store.rs, active_plugin_version sorts ascending and takes the last entry:

discovered_versions.sort_unstable_by(|left, right| compare_plugin_versions(left, right));
...
discovered_versions.pop()

Codex's own installer calls remove_old_plugin_versions after staging, which skips the version being installed and any name that is not a valid version segment.

Notes

• Pruning runs after the new version is copied into place, so a failed copy cannot leave the cache empty.
• The version-segment rule mirrors Codex's validate_plugin_version_segment (non-empty, not a traversal, ASCII letters, digits, ., +, _, -). Directories that fail it are left alone, since Codex would never activate them.
• The report gains removed_stale_version_paths so the action is visible rather than silent.

Test plan

• npm run check passes (111 internal tests).
• New coverage: a newer stale version directory is removed and reported; a directory whose name is not a valid version segment is left in place. The two pre-existing plugin-cache tests still pass.