fix: harden plugin feature gating (#15020)

1. Use requirement-resolved config.features as the plugin gate.
2. Guard plugin/list, plugin/read, and related flows behind that gate.
3. Skip bad marketplace.json files instead of failing the whole list.
4. Simplify plugin state and caching.

codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json

@@ -8744,6 +8744,19 @@
           ],
           "type": "string"
         },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "custom": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "custom"
+          ],
+          "title": "CustomSessionSource",
+          "type": "object"
+        },
         {
           "additionalProperties": false,
           "properties": {
@@ -10857,6 +10870,7 @@
         "vscode",
         "exec",
         "appServer",
+        "custom",
         "subAgent",
         "subAgentReview",
         "subAgentCompact",