feat: add native Codex plugin support

[jdehorty]

Summary

• add the native .codex-plugin/plugin.json manifest for the existing skills, SessionStart hook, and Chrome DevTools MCP server
• add a Codex marketplace catalog at .agents/plugins/marketplace.json using the Git-backed repository-root plugin source
• put Codex support first in Quick Start with a single copy-paste marketplace-and-plugin install command
• present Codex and Claude Code as equal native plugin targets in compatibility and repository-layout documentation

Why

The repository already offers streamlined Claude Code marketplace discovery, but Codex users do not have equivalent plugin metadata or an installation path. This adds native Codex discovery and installation without duplicating the canonical skills tree.

User impact

Codex users can install everything with:

codex plugin marketplace add CesiumGS/cesiumjs-skills && codex plugin add cesiumjs-skills@cesiumjs-skills

A new Codex session then loads the installed skills and tools.

Validation

• Codex plugin validator passes
• JSON manifests parse successfully
• exact documented one-line flow passes against an isolated Codex home and Git mirror
• installed plugin reports version 0.3.0 as enabled
• SessionStart hook output parses as valid JSON
• git diff --check passes

Closes #14

[arnob-mallick]

authentication: ON_INSTALL will prompt users for credentials on install. I don't think this plugin actually needs auth for anything:

• The only MCP server (chrome-devtools-mcp) just spawns a local headless Chrome process — no account, no API key.
• The SessionStart hook only reads a local SKILL.md file off disk.
• The "token" mentions in the skill docs (Ion tokens, Mapbox/ArcGIS keys) are guidance for end users writing CesiumJS apps, unrelated to installing this plugin.

Recommend removing this field (or setting it to whichever value means "not required" in Codex's schema) unless there's a Codex-specific reason for it I'm missing.

[arnob-mallick]

Worth flagging before merge: chrome-devtools-mcp requires Chrome to already be installed — it doesn't bundle its own Chromium like Puppeteer/Playwright do (source). Claude Code also has no clean per-user opt-out today for a plugin-bundled MCP server (anthropics/claude-code#27105, #17921), so a Chrome-less user gets a failing server every session with no easy escape hatch. It's also unpinned (@latest), so every session does a fresh npx fetch.

Given the rest of this repo treats Claude/Codex integrations as additive on top of a portable Agent-Skills core, might be worth making the browser-verification tooling an opt-in/documented setup step instead of a forced install-time dependency — fails safe for people without Chrome instead of failing loud.

[arnob-mallick]

If you personally find it useful, imo write a tutorial on how to set it up, but don't make browser-verification a feature of this repo.