Title: Marketplace upgrades leave full git clones

What issue are you seeing?

Bug: Each marketplace "upgrade" of a git-sourced marketplace clones the
full repo (incl. .git history) into ~/.codex/.tmp/marketplaces/.staging/
marketplace-upgrade-XXXX, but the staging dir is never deleted after promotion.

Impact: Accumulated 1784 leftover clones = 277 GB on C: over ~3 days.
Only the single git marketplace (claude-mem) was affected; local marketplaces
don't clone. Each clone = 171 MB, of which 158 MB is .git history.

Two issues:

1. Staging temp not cleaned up after upgrade.
2. Full clone instead of shallow (--depth 1) re-downloads entire git history

every refresh.

Env: Codex CLI app version 26.616.71553, Windows 11.
High session churn (automated runs) multiplies the leak.

Workaround: manually delete ~/.codex/.tmp/marketplaces/.staging

### What steps can reproduce the bug?

## Steps to reproduce

1. Configure a git-sourced marketplace in ~/.codex/config.toml:
   [marketplaces.example]
   source_type = "git"
   source = "https://github.com/thedotmack/claude-mem.git"

2. Trigger a marketplace upgrade/refresh repeatedly (happens on session
   start; automated/looping sessions trigger it many times).

3. Inspect ~/.codex/.tmp/marketplaces/.staging/ — a new
   `marketplace-upgrade-XXXXXX` dir is created per upgrade.

4. After the upgrade completes, the staging dir is NOT deleted. Each one
   is a full clone (~171 MB; ~158 MB is .git history).

5. Over many upgrades they accumulate without cleanup.

## Observed
1784 leftover `marketplace-upgrade-*` dirs = 277 GB on C:, accumulated over
~3 days. Only the single git marketplace was affected (local marketplaces
don't clone).

## Note
Root cause inferred from the 1784 leftover clones + config (not captured
live). Two defects: (1) staging temp never cleaned after promote;
(2) full clone instead of shallow (--depth 1) re-downloads entire git
history every refresh.

## Env
Codex CLI app version 26.616.71553, Windows 11.

### What is the expected behavior?

1. After a marketplace upgrade is promoted, the temporary staging directory
   (~/.codex/.tmp/marketplaces/.staging/marketplace-upgrade-XXXXXX) is
   deleted automatically. No leftovers remain.
2. Stale or failed staging directories are cleaned up on the next startup,
   so they cannot accumulate across sessions.
3. Git-sourced marketplaces are fetched with a shallow clone (--depth 1)
   and/or updated in place (git fetch/pull on a cached copy) instead of a
   full re-clone of the entire history on every refresh.
Net result: marketplace refreshes use minimal, bounded disk space that does
not grow over time.

### Additional information

_No response_