Allow per-plugin opt-out of curated checkout — Wix reference doc triggers Monarx malware false positive

Codex CLI 0.146.0 syncs the entire implicit openai-curated marketplace (a clone of openai/plugins, ~177 plugins) into $CODEX_HOME/.tmp/plugins, even when zero plugins are installed.

The benign shipped reference file
$CODEX_HOME/.tmp/plugins/plugins/wix/skills/wix-headless/references/astro/cms/RESOURCE_LIBRARY.md
is flagged as Malicious by the Monarx malware scanner (bundled with common managed VPS hosting, e.g. Hostinger). The false-positive shape appears to be documentation vocabulary about downloadable resources, download buttons, file URLs, and media URLs — the file contains no executable or encoded content.

Deleting the file is not durable: the curated checkout's hard-reset resync restores it. There is no supported narrower fix in 0.146.0: per-plugin config covers enabled and MCP policy only, plugin remove applies only to installed plugins, and the implicit marketplace cannot be removed or sparse-checked-out.

Request: a supported per-plugin exclusion from the curated checkout (e.g., exclude wix), or packaging of plugin reference docs in a heuristic-safe form. features.plugins = false works as a global opt-out but is too broad for users who want other plugins.