fix(codex): accept first-party OpenAI plugin marketplaces

Allow Codex native plugin config to target first-party OpenAI marketplaces, including openai-curated, openai-bundled, and openai-primary-runtime.

Fixes #82216.
Thanks @yaanfpv for the contribution.

Verification:
- node scripts/run-vitest.mjs test/scripts/lint-suppressions.test.ts
- pnpm build:ci-artifacts
- OPENCLAW_VITEST_MAX_WORKERS=2 node scripts/run-vitest.mjs run --config test/vitest/vitest.full-core-support-boundary.config.ts test/scripts/lint-suppressions.test.ts
- node scripts/run-vitest.mjs extensions/codex/src/app-server/config.test.ts extensions/codex/src/app-server/plugin-activation.test.ts extensions/codex/src/app-server/session-binding.test.ts extensions/codex/src/migration/provider.test.ts extensions/sms/src/channel.test.ts extensions/sms/src/inbound.test.ts
- git diff --check
- ./.agents/skills/autoreview/scripts/autoreview --mode local
- GitHub PR CI on head 896640060b, including build-artifacts run 26709647050

docs/plugins/codex-native-plugins.md

@@ -3,7 +3,7 @@ summary: "Configure migrated native Codex plugins for Codex-mode OpenClaw agents
 title: "Native Codex plugins"
 read_when:
   - You want Codex-mode OpenClaw agents to use native Codex plugins
-  - You are migrating source-installed openai-curated Codex plugins
+  - You are configuring first-party Codex plugin marketplaces
   - You are troubleshooting codexPlugins, app inventory, destructive actions, or plugin app diagnostics
 ---
 
@@ -22,7 +22,9 @@ Use this page after the base [Codex harness](/plugins/codex-harness) is working.
 - The selected OpenClaw agent runtime must be the native Codex harness.
 - `plugins.entries.codex.enabled` must be true.
 - `plugins.entries.codex.config.codexPlugins.enabled` must be true.
-- V1 supports only `openai-curated` plugins that migration observed as
+- V1 supports first-party Codex plugin marketplaces: `openai-curated`,
+  `openai-bundled`, and `openai-primary-runtime`.
+- Migration only auto-discovers `openai-curated` plugins that it observed as
   source-installed in the source Codex home.
 - The target Codex app-server must be able to see the expected marketplace,
   plugin, and app inventory.
@@ -52,9 +54,11 @@ Apply the migration when the plan looks right:
 openclaw migrate apply codex --yes
 ```
 
-Migration writes explicit `codexPlugins` entries for eligible plugins and calls
-Codex app-server `plugin/install` for selected plugins. A typical migrated
-config looks like this:
+Migration writes explicit `codexPlugins` entries for eligible curated plugins
+and calls Codex app-server `plugin/install` for selected plugins. Explicit
+config may also reference Codex's bundled and primary-runtime first-party
+marketplaces when the target app-server inventory exposes those plugin apps. A
+typical migrated config looks like this:
 
 ```json5
 {
@@ -146,8 +150,10 @@ up the updated app set.
 
 V1 is intentionally narrow:
 
+- Runtime config accepts `openai-curated`, `openai-bundled`, and
+  `openai-primary-runtime` plugin identities.
 - Only `openai-curated` plugins that were already installed in the source Codex
-  app-server inventory are migration-eligible.
+  app-server inventory are migration-eligible for automatic migration.
 - App-backed source plugins must pass the migration-time subscription gate.
   `--verify-plugin-apps` adds the source app-inventory gate. Subscription-gated
   accounts plus, in verification mode, inaccessible, disabled, missing source
@@ -160,7 +166,9 @@ V1 is intentionally narrow:
 - There is no `plugins["*"]` wildcard and no config key that grants arbitrary
   install authority.
 - Unsupported marketplaces, cached plugin bundles, hooks, and Codex config files
-  are preserved in the migration report for manual review.
+  are preserved in the migration report for manual review. Bundled and
+  primary-runtime first-party plugins can still be added manually through
+  explicit `codexPlugins` config.
 
 ## App inventory and ownership
 
@@ -248,8 +256,10 @@ app-server auth or rerun with `--verify-plugin-apps` if you want source app
 inventory to decide eligibility when account lookup fails.
 
 **`marketplace_missing` or `plugin_missing`:** the target Codex app-server
-cannot see the expected `openai-curated` marketplace or plugin. Rerun migration
-against the target runtime or inspect Codex app-server plugin status.
+cannot see the expected first-party marketplace or plugin. Rerun migration
+against the target runtime, inspect Codex app-server plugin status, or confirm
+the explicit `marketplaceName` is one of `openai-curated`, `openai-bundled`, or
+`openai-primary-runtime`.
 
 **`app_inventory_missing` or `app_inventory_stale`:** app readiness came from an
 empty or stale cache. OpenClaw schedules an async refresh and excludes plugin