Support plain HTTPS marketplace.json endpoints as plugin marketplace sources

Problem

codex plugin marketplace add <SOURCE> currently accepts a local path, owner/repo[@ref], or a Git URL (HTTPS/SSH). Any HTTPS URL is treated as a Git repository and materialized via git clone (codex-rs/core-plugins/src/marketplace_add/source.rs, install.rs), with the manifest read from .agents/plugins/marketplace.json inside the repo.

Claude Code additionally supports adding a marketplace from a plain HTTPS endpoint that serves the marketplace JSON document, e.g.:

claude plugin marketplace add https://internal.example.com/api/plugin-catalogs/main

This is very useful for enterprises: the catalog is generated dynamically from an internal plugin registry, and there is no natural Git repository to clone.

Proposal

Accept an HTTPS URL that points to a marketplace JSON document (e.g. by content negotiation, a --format json flag, or a .json path suffix) and materialize it by fetching the document over HTTP instead of git clone. Refresh (codex plugin marketplace upgrade) would re-fetch the URL.

Context

• PR [#17756](<https://github.com/openai/codex/issues/17756>) mentioned "direct marketplace.json URL sources", but the current CLI flow introduced in [#21396](<https://github.com/openai/codex/issues/21396>) only supports git/local sources.
• openai/codex#27831 is related in spirit: marketplace entries with non-git sources from the Claude Code format are dropped.
• PR [#30297](<https://github.com/openai/codex/issues/30297>) enables remote plugins by default, but that channel goes through the Codex backend and doesn't cover self-hosted enterprise catalogs.
• PR openai/codex#28383 shows the machinery already exists internally: the OpenAI curated marketplace manifest is selected/loaded outside of git clone; this proposal is essentially asking to open the same capability to self-hosted endpoints.
• openai/codex#25750 raises the same enterprise need for MCP server catalogs ("connect to an enterprise catalog with a single command"); this issue is the plugin-marketplace counterpart.
• openai/codex#8925 was the original plugin-marketplace feature request; marketplace support has landed since, but only with git/local sources.

(Searched existing issues/PRs for "marketplace url/json/http/endpoint/source" before filing — no duplicate found.)

Workaround today

Mirror the dynamic catalog into a Git repository and marketplace add that repo, which duplicates infrastructure for what is conceptually a single HTTP endpoint.