[codex] Gate remote plugin catalog by auth

[xl-openai]

Summary

• Treat the remote global plugin catalog as active only when remote_plugin is enabled and the current auth uses the Codex backend.
• Skip the local OpenAI curated marketplace for remote-enabled ChatGPT users while preserving configured marketplaces.
• Keep the local curated marketplace for API-key users, unauthenticated fallback, and ChatGPT users with remote_plugin disabled.
• Apply the same effective-remote gate to the remote installed-marketplace cache.

Root cause

The tool-suggestion discovery path unconditionally included the local OpenAI curated marketplace. For remote-enabled ChatGPT users, that made remote discovery additive: Codex parsed every local curated plugin.json before also loading the remote catalog.

Validation

• just fmt
• cargo build -p codex-cli --bin codex
• Targeted auth/feature matrix tests pass, including API-key auth with remote_plugin enabled.
• Manual CLI validation confirmed:
  • ChatGPT + remote off includes local curated.
  • ChatGPT + remote on excludes local curated.
  • API-key auth keeps local curated when remote is enabled.
• just test -p codex-core-plugins: 235 passed; one unrelated existing marketplace test failed because it loaded the developer's home marketplace configuration.