Configured marketplace upgrades leak staging clones

What happened

Interrupted configured Git marketplace upgrades can leave ~/.codex/.tmp/marketplaces/.staging/marketplace-upgrade-* directories permanently. One installation accumulated 8,448 directories and more than 1 TiB over a month. A separate installation reproduced 2,126 directories / about 98 GiB.

Root cause

upgrade_configured_git_marketplace relies on TempDir drop for cleanup. If an app-server process is interrupted or replaced, that destructor does not run. ConfiguredMarketplaceUpgradeState::in_flight is process-local, so separate app-server processes can clone concurrently, and this staging path has no stale sweep. The curated plugins sync already has both a cross-process file lock and age-bounded temp cleanup.

The Git commands are individually bounded at 30 seconds, making a ten-minute stale threshold conservative.

Suggested fix

• serialize configured marketplace upgrades with an OS-backed lock under CODEX_HOME/.tmp
• sweep only marketplace-upgrade-* directories older than ten minutes while holding that lock
• re-read on-disk marketplace config after lock acquisition so a waiting process skips a stale config snapshot
• preserve recent directories, backup directories, unrelated entries, and symlinks

A tested implementation is available at https://github.com/wey-gu/codex/commit/1bb3ae37f

Validation: just test -p codex-core-plugins passes 319/319 with an isolated home, including a two-thread concurrent upgrade test; just fix -p codex-core-plugins passes.

Relevant code

Introduced by configured marketplace auto-upgrade in faf48489; current path: codex-rs/core-plugins/src/marketplace_upgrade.rs.