Fix Codex marketplace coverage routing

[pengfei-threemoonslab]

Summary

• Treat valid local Codex plugin roots reached through a declared marketplace as declared tool surfaces, so shipgate check routes their changes to verify.
• Deduplicate marketplace-covered package candidates in detect, generated init manifests, and the zero-install detector.
• Fail closed for malformed, non-UTF-8, oversized, remote, escaping, and manifest-symlink marketplace inputs.
• Reject external-target .codex-plugin/plugin.json symlinks for both marketplace and direct-package loading.

Root cause

The repository already declares .agents/plugins/marketplace.json, and that marketplace locally reaches plugins/agents-shipgate. The boundary and discovery consumers only understood the literal marketplace path, so a nested plugin change was misclassified as undeclared and first-adoption discovery proposed a redundant direct package row.

Adding that row is not the fix: it loads the same plugin root twice, produces a duplicate-root warning, and degrades verification evidence. This PR makes the existing transitive declaration visible to routing and discovery instead.

Contract scope

This is a contract-v18 bugfix only. It adds no v19 contract, schema, adapter, enterprise surface, manifest row, trust-root edit, or policy weakening.

Validation

• Updated preflight: agent_action_required -> verify; no protected-surface touch or human-review requirement.
• Exact committed-head verification against origin/main: control.state=complete, merge_verdict=mergeable, release_decision=passed, zero blockers, review items, or source warnings.
• Reproduced receipt: sha256:01b6383b8483242f52f9b7116b2740898a312ed000e2f786c5bd7d6c2ab6c264.
• Full non-packaging test suite passed.
• Packaging suite: 8 passed.
• Focused marketplace/detection/adapter regressions: 146 passed, 1 skipped.
• P0 safety, P0 binding, and agent-boundary canaries passed.
• ruff check . and git diff --check passed.
• Three independent final reviews found no blocker.

The Shipgate result is static-analysis evidence only; runtime behavior was not executed or verified.