fix(codex-config): close whole-branch review defects in the Codex panel

Plugins/marketplaces GET routes were silently empty because codex-cli.js
never unwrapped the CLI's {installed,available}/{marketplaces} objects
into arrays; backup writes bypassed the symlink-escape guard entirely;
readFileSafe was stricter than every other Codex reader, showing a
symlinked skill/rule in the list and then refusing to open it;
marketplaceAdd only accepted http(s) URLs, rejecting owner/repo sources
the CLI itself takes. Also: docs drift, a dead i18n key, and a scope-cast
hazard in the shared Editor/ConfirmDelete modals.

Fixes, one per finding: unwrap installed/marketplaces in codex-cli.js so
every list route keeps returning a bare list; guard the backup path in
codex-mutate.js with the same assertNotSymlinkEscape the write path
already used (Claude's cc-mutate.js has no such guard on its primary
write path either, so left untouched there); relax readFileSafe's
containment to lexical-only, matching the other four Codex readers,
while leaving the write side's realpath check untouched; reuse
cc-plugin-cli's assertSource for marketplaceAdd instead of a third
validator (ssh remains out of scope, no credential story for it yet).

Server: 1557/1557 (was 1548). Client: tsc -b clean, 469/469 tests.

client/src/components/config/EditorModal.tsx

@@ -12,7 +12,16 @@ import { useTranslation } from "react-i18next";
 import { Pencil, X, Save, AlertCircle } from "lucide-react";
 import type { CcArtifactType } from "../../lib/api";
 
-export type EditorState<TType extends string = CcArtifactType> =
+/** Claude Code's own scope union, kept as the default so existing callers
+ *  (CcConfig.tsx) don't need to name it. Codex has no `auto-memory` scope —
+ *  its caller instantiates `TScope` as just `"user" | "project"` instead of
+ *  casting its own narrower type into this one. */
+type DefaultScope = "user" | "project" | "auto-memory";
+
+export type EditorState<
+  TType extends string = CcArtifactType,
+  TScope extends string = DefaultScope,
+> =
   | {
       mode: "create";
       type: TType;
@@ -23,7 +32,7 @@ export type EditorState<TType extends string = CcArtifactType> =
   | {
       mode: "edit";
       type: TType;
-      scope: "user" | "project" | "auto-memory";
+      scope: TScope;
       name: string;
       filePath: string;
       project?: string; // set for type === "auto-memory"
@@ -34,13 +43,16 @@ export type EditorState<TType extends string = CcArtifactType> =
  *  AGENTS.md / config.toml) - no `name` field, and no artifact name is ever sent. */
 const DEFAULT_NAMELESS_TYPES = ["memory"];
 
-interface EditorModalProps<TType extends string = CcArtifactType> {
-  state: NonNullable<EditorState<TType>>;
+interface EditorModalProps<
+  TType extends string = CcArtifactType,
+  TScope extends string = DefaultScope,
+> {
+  state: NonNullable<EditorState<TType, TScope>>;
   fetchContent: (filePath: string) => Promise<string>;
   onClose: () => void;
   onSave: (args: {
     type: TType;
-    targetScope: "user" | "project" | "auto-memory";
+    targetScope: TScope;
     name: string | undefined;
     content: string;
     project?: string;
@@ -50,13 +62,16 @@ interface EditorModalProps<TType extends string = CcArtifactType> {
   namelessTypes?: readonly string[];
 }
 
-export function EditorModal<TType extends string = CcArtifactType>({
+export function EditorModal<
+  TType extends string = CcArtifactType,
+  TScope extends string = DefaultScope,
+>({
   state,
   fetchContent,
   onClose,
   onSave,
   namelessTypes = DEFAULT_NAMELESS_TYPES,
-}: EditorModalProps<TType>) {
+}: EditorModalProps<TType, TScope>) {
   const { t } = useTranslation("ccConfig");
   const isCreate = state.mode === "create";
   const isNameless = namelessTypes.includes(state.type);
@@ -64,7 +79,11 @@ export function EditorModal<TType extends string = CcArtifactType>({
   const [content, setContent] = useState<string>(isCreate ? state.template : "");
   const [name, setName] = useState<string>("");
   const [targetScope, setTargetScope] = useState<"user" | "project">(
-    isCreate ? state.defaultScope : state.scope === "auto-memory" ? "user" : state.scope
+    isCreate
+      ? state.defaultScope
+      : state.scope === "auto-memory"
+        ? "user"
+        : (state.scope as "user" | "project")
   );
   const [loading, setLoading] = useState(!isCreate);
   const [saving, setSaving] = useState(false);
@@ -111,7 +130,12 @@ export function EditorModal<TType extends string = CcArtifactType>({
         state.mode === "edit" ? state.name : isNameless ? undefined : createName;
       await onSave({
         type: state.type,
-        targetScope: isAutoMemory ? "auto-memory" : targetScope,
+        // Widening back to TScope: this component is the one place that
+        // legitimately knows about all three scope shapes across both
+        // callers; a Codex caller's TScope ("user" | "project") never
+        // actually receives "auto-memory" since isAutoMemory can only be
+        // true when TType includes "auto-memory" (Claude-only).
+        targetScope: (isAutoMemory ? "auto-memory" : targetScope) as TScope,
         name: effectiveName,
         content,
         project: state.project,