[codex] Avoid forced directory refresh during plugin install auth checks

[xl-openai]

Summary

• Use normal directory loading for plugin install app metadata so install avoids forced directory refresh while still loading metadata on cold cache.
• Continue force-refreshing codex_apps tools for auth state.
• Add regression coverage that pre-warms the directory cache and asserts install returns cached app metadata without extra directory requests.

Validation

• just fmt
• git diff --check
• just test -p codex-app-server plugin_install_returns_apps_needing_auth plugin_install_filters_disallowed_apps_needing_auth (blocked locally: cargo-nextest is not installed)