Marketplace upgrade staging directories leak in `.tmp/marketplaces/.staging/`

Summary

Marketplace upgrade and add operations create temporary staging directories under <CODEX_HOME>/.tmp/marketplaces/.staging/ with prefixes marketplace-upgrade-* and marketplace-add-*. If the process crashes or is killed during these operations, the TempDir destructor never runs and these directories accumulate permanently with no cleanup.

On an active installation this can grow to hundreds of GB over time (each git clone is ~230MB). I personally found 2293 orphaned directories totalling 187GB on a single machine:

$ du -sh ~/.codex/.tmp/marketplaces/.staging/
187G

$ ls ~/.codex/.tmp/marketplaces/.staging/ | wc -l
2293

Root Cause

There are three leak paths:

1. Process crash/kill: TempDir in marketplace_upgrade.rs:195-203 is never dropped, staging dir is orphaned permanently.
2. Git clone timeout (30s in git.rs): Partially cloned directories remain in .staging/ with no cleanup.
3. Activation error path in activation.rs:94-127: backup_dir.keep() is called on double-failure (rename fails AND rollback fails), permanently preserving marketplace-backup-* directories.

There is no equivalent of remove_stale_curated_repo_temp_dirs() (which exists in startup_sync.rs:258-341 for plugins-clone-* dirs) for the marketplace staging path.

Proposed Fix

Add remove_stale_marketplace_temp_dirs() modeled after the existing cleanup in startup_sync.rs, called at the start of:

• upgrade_configured_git_marketplaces()
• add_marketplace_sync_with_cloner()

Cleans up directories older than 10 minutes, covering:

• marketplace-upgrade-* in .staging/
• marketplace-add-* in .staging/
• marketplace-backup-* at the install root level

Related

• #16004 — similar leak for plugins-clone-* directories in startup_sync.rs
• #19834 — stale marketplace clone discoverability (separate concern)