[codex] Cover auth-routed plugin tool visibility

[felixxia-oai]

Context

This is PR2 in the plugin auth-routing stack. The broader goal is to enable plugins for API-key login users while preserving the existing ChatGPT/SIWC connected-app path. Plugins with app definitions authenticate through SIWC today; API-key users need the equivalent plugin capability through MCP/OAuth.

PRs Goals

The goal of this stack is to add guardrails that ensure Codex includes the appropriate plugin app and MCP surfaces based on the auth type.

• PR1: filter effective MCP servers by auth/app-route availability.
• PR2: add explicit-plugin integration coverage for the SWIC and API-key routes.
• PR3: suppress install-time MCP OAuth when a plugin app route is available.

Summary

• Add integration coverage for explicit mentions of a dual-surface plugin.
• Verify ChatGPT/SIWC sessions expose the plugin app tool path and do not expose the plugin-owned MCP tool.
• Verify API-key sessions expose the plugin-owned MCP tool path and do not expose the plugin app tool.
• Keep this PR test-focused so the routing behavior from PR1 is covered without adding another production filtering layer.

Validation

git diff --check
cargo test -p codex-core --test all explicit_plugin_mentions_use_

Both pass locally.