Fix Codex marketplace coverage routing

[pengfei-threemoonslab]

Summary

• Treat valid local Codex plugin roots reached through a declared marketplace as declared tool surfaces, so shipgate check routes their changes to verify.
• Deduplicate marketplace-covered package candidates in detect, generated init manifests, and the zero-install detector.
• Fail closed for malformed, non-UTF-8, oversized, remote, escaping, and manifest-symlink marketplace inputs.
• Reject external-target .codex-plugin/plugin.json symlinks for direct-package loading; marketplace entries with the same escape are skipped and cannot grant coverage.
• Document the user-visible routing and containment changes in the Unreleased changelog.

Root cause

The repository already declares .agents/plugins/marketplace.json, and that marketplace locally reaches plugins/agents-shipgate. The boundary and discovery consumers only understood the literal marketplace path, so a nested plugin change was misclassified as undeclared and first-adoption discovery proposed a redundant direct package row.

Adding that row is not the fix: it loads the same plugin root twice, produces a duplicate-root warning, and degrades verification evidence. This PR makes the existing transitive declaration visible to routing and discovery instead.

Contract scope

This is a contract-v18 bugfix only. It adds no v19 contract, schema, adapter, enterprise surface, manifest row, trust-root edit, or policy weakening.

Validation

• Updated preflight: agent_action_required -> verify; no protected-surface touch or human-review requirement.
• Exact committed-head verification against origin/main: control.state=complete, merge_verdict=mergeable, release_decision=passed, zero blockers, review items, or source warnings.
• Reproduced receipt: sha256:b5e3c382ac899c8cd360cb7a96e086f7899d075457493abc1654b8ced9f7c057.
• Full non-packaging test suite passed.
• Packaging suite: 8 passed.
• Focused marketplace/detection/adapter regressions passed, including contained absolute paths and the workspace-root anti-overmatch guard (one platform-dependent symlink test skipped).
• P0 safety, P0 binding, and agent-boundary canaries passed.
• ruff check . and git diff --check passed.
• Three independent final reviews found no blocker.

The Shipgate result is static-analysis evidence only; runtime behavior was not executed or verified.