fix: inspect native Codex plugin and hook materialization in Doctor

[HengYangDS]

Summary

Make Codex Doctor inspect native plugin materialization and hook configuration instead of obsolete feature flags and explicit-MCP assumptions. Plugin-provided servers need not appear in codex mcp list. Failed native inspection is unknown, not absence; a deliberately disabled hook must not trigger advice to override policy.

• Inspect native plugin details independently of marketplace, version and source directory.
• Keep plugin materialization, explicit MCP, hook execution/trust and runtime tool-loop qualification distinct.
• Preserve structured stdout, close stdin and bound native subprocess observations.
• Do not modify models, providers, credentials, plugin policy or hook trust.

This is one generic Doctor change, not the larger local indexing/admission stack. Integration base: 7e06519357777badd7a115d2014a7ef845904310. Head: e2b33875433d5f8eac335de06a06a6fde33f851d.

Validation

• node node_modules/vitest/vitest.mjs run test/codex-doctor.test.ts test/doctor-observations.test.ts --reporter=dot: 14/14 pass under declared Vitest 3.2.7. The earlier Vitest 5 result is not used as declared-toolchain compatibility evidence.
• node node_modules/typescript/bin/tsc --noEmit: passes with TypeScript 5.9.3.
• git diff --check: passes. Source, manifests and committed lockfiles are unchanged by toolchain qualification.
• Installation warnings about the existing allowScripts ownership and deprecated prebuild-install are retained, not suppressed.

Hosted fork CI still requires maintainer approval and has not executed. A native CLI/model tool loop on this rebased branch was not run. Configuration diagnostics do not establish model/storage health or all-consumer acceptance.

[HengYangDS]

Author follow-up on exact head e2b3387: the previously disclosed declared-toolchain evidence gap is now resolved. The original two focused test files pass 14/14 under the repository-declared Vitest 3.2.7, and TypeScript 5.9.3 --noEmit passes. Source and committed manifests/locks are unchanged; no live plugin installation, credential, model or policy update was made. Native install warnings are retained, including the pre-existing allow-scripts configuration warning and prebuild-install deprecation. This is local acceptance, not hosted CI: exact-head Actions still require maintainer approval before execution. Please approve and run the waiting checks, then review the narrow native Doctor behavior for merge.