fix(runtime): reuse unchanged plugins across concurrent scans

[msapelov]

Summary

Starting another same-version scan currently runs codex plugin add again,
replacing the directory used by an active MCP coordinator. A later worker
inherits the deleted working directory and fails with os error 2, even when
its thread specifies workingDirectory.

Reuse a verified unchanged installation so concurrent scans can continue
starting workers. This preserves the parallel ChatGPT scanning enabled by #440
and keeps shared startup mutations under the existing lock. Fixes #824.

Changes

• Retain the installation path returned by Codex and reuse it when registration,
  source, and installed contents match.
• Refresh changed custom plugin contents even when the version is unchanged;
  continue repairing missing files and registration.
• Add a real-process regression for an active coordinator and focused coverage
  for reuse, runtime-generated files, relocated sources, and repair.

Testing

• The new process regression fails on the unmodified base and passes with the fix.
• The compiled runtime passes an isolated Node/Codex SDK reproduction with both
  the released and current plugin payloads. Empty prompts avoid model requests.
• Focused runtime tests: 167 passed, 21 platform skips, 0 failures.
• Build, type checks, formatting, and git diff --check: passed.
• Full isolated SDK suite: 2,427 passed, 43 skipped, 0 failed, across 119 files
  (seed 1529161043). The initial sandboxed run hit environment restrictions;
  all affected tests passed after isolating the test home and allowing local
  server/process checks, before the successful complete rerun.

Risk and rollout

The change preserves parallel scanning and uses the existing startup lock.
It adds an internal installation record without changing public CLI options or
dependency versions. Content checks read the plugin payload during bootstrap.

This addresses repeated installation of identical contents. Upgrades, custom
plugin changes, repairs, and older SDK processes can still replace an active
installation. An older installation without the record is installed normally
once. Finish existing scans before switching builds; protecting active scans
through actual replacements is a separate follow-up.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.