Plugin installation copies source `.git` metadata into the installed cache

Installing a local plugin whose root is a Git repository copies its .git
directory into plugins/cache/<marketplace>/<plugin>/<version>. This duplicates
repository objects and history in the runtime cache. For a Git worktree, the
.git pointer file is copied verbatim; its pointer may be invalid after
relocation.

Observed with Codex CLI 0.153.4 on macOS 26.6.2 (x86_64). The same recursive copy
implementation is present at upstream commit
52e12e0cb506e7bb2c9e406fc84d922e274a0e40. One real local plugin installation
contained 54 intended files plus 129 extra .git files (317,459 bytes).

Reproduction:

1. Use a valid local plugin from a configured marketplace. Place its
   .codex-plugin/plugin.json and skills/ at the repository root, alongside
   .git/.
2. Run codex plugin add <plugin>@<marketplace>.
3. Inspect the installed version directory. Its .git/ directory includes the
   source repository metadata.
4. A plugin rooted in a worktree copies its .git pointer file instead. Nested
   .git entries are copied as well.

Expected: exclude Git administration entries from installed plugin payloads,
while preserving .codex-plugin, .mcp.json, .gitignore, .gitattributes,
.github, ordinary assets, and executable file permissions. Leave the source
repository unchanged.

Root cause: copy_dir_recursive in
store.rs
copies every directory and regular file without a .git exclusion. The existing
staging and activation boundary can remain unchanged. Skipping exact .git
entries before inspecting or traversing them is a small candidate correction.
This does not require broad dotfile filtering or configurable ignore rules.

Validation of a local candidate correction:

• Three installation regression tests failed on the unchanged implementation,
  each because .git was present in the resulting cache.
• After adding the exact-name exclusion, just test -p codex-core-plugins passed
  all 441 tests, with zero failures and zero skips, on macOS x86_64.
• Coverage includes root directory and worktree-file forms, nested metadata,
  preserved dotfiles and source contents, Unix executable permissions, and
  replacement of an existing cached version containing old metadata.
• just fmt and git diff --check passed. No dependency or configuration changes
  are needed. Linux and Windows execution have not been performed.

The three added tests use synthetic plugin sources and explicit temporary store
roots. They do not redirect HOME or CODEX_HOME or modify real user configuration.

Related issues #18863 and #24770 concern skipped symlinks. This report concerns
unwanted Git metadata copying and proposes no change to symlink handling.

Start in codex-rs/core-plugins/src/store.rs at copy_dir_recursive and review the three installation regression tests described in the issue. Exclude exact .git entries before inspecting or traversing them, while preserving the listed dotfiles, permissions, and source contents. Run just test -p codex-core-plugins, then just fmt and git diff --check; done means no Git metadata remains in the cache and the existing tests pass.