[bug] Upgrade Marketplaces trigger timeout after 30s would cause massive staging cache content in ".tmp" folder

What version of the Codex App are you using (From “About Codex” dialog)?

26.813.12317

What subscription do you have?

plus

What platform is your computer?

Darwin 25.6.0 arm64 arm

What issue are you seeing?

Two related problems in the configured-marketplace auto-upgrade path
(codex-rs/core-plugins/src/marketplace_upgrade.rs):

1. The 30s git timeout is hardcoded and unrealistic for large repos

const MARKETPLACE_UPGRADE_GIT_TIMEOUT: Duration = Duration::from_secs(30);

Every auto-upgrade attempt runs a full git clone under this budget. For a
marketplace backed by a large repository (my case: volcengine/OpenViking,
~332MB worktree + ~236MB .git) on a modest connection, 30s is never enough,
so the upgrade fails every single time:

WARN codex_core_plugins::manager: failed to auto-upgrade configured marketplace
     marketplace="openviking"
     error=git clone marketplace source timed out after 30s

There is no config key, env var, or CLI flag to raise it — [marketplaces.*]
only accepts source_type, source, ref_name, sparse_paths,
last_updated, last_revision.

2. Failed upgrades leak their staging directories

Each attempt clones into a marketplace-upgrade-* temp dir under
~/.codex/.tmp/marketplaces/.staging/. After a timeout the directory is
abandoned, not deleted, and the upgrade is retried on every app restart /
periodic refresh. In ~6 hours this accumulated 194 orphaned directories,
43GB on my machine (mix of empty dirs, complete ~332MB clones, and partial
500–680MB clones). Since the clone is retried forever and never succeeds, the
disk usage grows unboundedly.

The staging dir is created with tempfile::Builder::new().prefix( "marketplace-upgrade-").tempdir_in(...), so it should self-clean on Drop —
empirically it does not when the upgrade fails.

What steps can reproduce the bug?

. Add a git-backed marketplace whose full clone takes >30s on your connection:

[marketplaces.openviking]
source_type = "git"
source = "https://github.com/volcengine/OpenViking.git"

2. Restart Codex (or wait for the periodic auto-upgrade).
3. Observe the WARN in the logs and a new marketplace-upgrade-* dir left
   behind in ~/.codex/.tmp/marketplaces/.staging/ each attempt.
4. du -sh ~/.codex/.tmp/marketplaces/.staging grows without bound.

What is the expected behavior?

No response

Additional information

No response

Start in codex-rs/core-plugins/src/marketplace_upgrade.rs, reading the MARKETPLACE_UPGRADE_GIT_TIMEOUT constant and the tempfile staging-directory creation. Reproduce with a git-backed marketplace whose clone exceeds 30 seconds, then trace the failed upgrade path. Done means failed upgrades no longer accumulate marketplace-upgrade-* directories and the timeout behavior works for large repositories.