[codex] Support plugin manifest path lists

[charlesgong-openai]

Summary

Allow plugin manifests to declare skills as either a single path string or an array of path strings in the core plugin loader.

Why

Some plugin packages need to expose skills from more than one directory. Before this change, plugin.json only accepted a single string for skills, so manifests like this were ignored as an invalid skills shape:

{
  "skills": ["./skills/abc", "./skills/edk"]
}

This keeps the existing single-string form working while adding support for the list form. The final scope is intentionally limited to the core plugin manifest/load path for skills; apps, file-backed mcpServers, and the bundled plugin-creator assets are unchanged in this PR.

What changed

• Parse skills as either a string or an array of strings in plugin.json.
• Store resolved skill paths as a list in PluginManifestPaths.
• Load manifest-declared skill roots in addition to the default ./skills root.
• Deduplicate exact duplicate skill roots before loading.
• Rely on existing skill-loader dedupe by canonical SKILL.md path for overlapping roots such as ./skills plus ./skills/abc.
• Update plugin manifest tests to cover:
  • single string skills
  • list of string skills
  • duplicate skill roots
  • ./skills as a manifest path
  • explicit child roots like ./skills/abc and ./skills/edk
  • overlapping-root dedupe

Validation

• just test -p codex-plugin
• just test -p codex-core-plugins
• just test -p codex-mcp-extension
• git diff --check

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9b7811e610

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".