Desktop: periodically auto-update plugin marketplaces without requiring a restart

Feature request

Codex Desktop currently starts the configured Git marketplace auto-upgrade as an app-server startup task. When the Desktop app stays open for days, marketplace and plugin updates are not checked again unless the app server is restarted or the user manually requests an upgrade.

Current implementation references:

• The marketplace auto-upgrade is spawned by maybe_start_plugin_startup_tasks_for_config: https://github.com/openai/codex/blob/6851fae57cf7306e1d7a093d334b1116d33ce5ad/codex-rs/core-plugins/src/manager.rs#L2135-L2196
• Desktop's app server invokes those tasks during startup: https://github.com/openai/codex/blob/6851fae57cf7306e1d7a093d334b1116d33ce5ad/codex-rs/app-server/src/message_processor.rs#L467-L477
• An upgraded marketplace triggers a refresh of installed plugin caches: https://github.com/openai/codex/blob/6851fae57cf7306e1d7a093d334b1116d33ce5ad/codex-rs/core-plugins/src/manager.rs#L2248-L2305

Desired behavior

While Codex Desktop remains running:

• Periodically check configured Git marketplaces for new revisions.
• Refresh installed plugins when their marketplace source changes, without requiring a full Codex restart.
• Coalesce concurrent checks and use reasonable backoff/idle scheduling so this does not add noticeable startup, network, or Git overhead.
• Show the last check time, update result, and failures in the Plugins UI.
• Provide a Check for updates action in addition to automatic checks.

Applying an update to existing threads must be safe and consistent. Either:

1. atomically hot-reload all capabilities from the new plugin version, including skills, hooks, MCP servers, and apps; or
2. keep existing threads on the complete previous version and apply the new version only to new threads.

A running thread should never silently mix capabilities from different plugin versions.

Why

Desktop is commonly kept open for long periods. Requiring a restart means users can remain on stale plugin code without any visible indication, even though startup auto-upgrade support already exists.

Related issues

• #31383 documents the current startup marketplace auto-upgrade behavior and cache replacement.
• #17636 requests hot-reloading hook configuration during a live session.
• #36605 reports mixed skill/hook versions after updating a plugin in Desktop.

Those issues cover update side effects or hot-reload behavior, but not periodic marketplace/plugin update checks while Desktop remains running.

Read maybe_start_plugin_startup_tasks_for_config in codex-rs/core-plugins/src/manager.rs and the startup call in codex-rs/app-server/src/message_processor.rs. Trace the existing cache refresh path, then define the scheduling, Plugins UI status/action, and thread-version behavior needed for safe periodic updates. Done means checks can run while Desktop stays open without mixed plugin capabilities.