dev --install-host codex leaves a dangling marketplace registration that breaks `codex plugin list` for every plugin

[ScriptedAlchemy]

Observed 2026-09-06 08:50 UTC on this machine after Workbench/host-adoption acceptance runs:

~/.codex/config.toml still contained a marketplace audiobook-curator-marketplace whose source was /tmp/agent-bundle-dev-codex-Ownv5r/bundle — a dev bundle directory that no longer exists. Consequence: codex plugin list --json fails outright (failed to load configured marketplace snapshot(s): … marketplace root does not contain a supported manifest), so cargo-hauler-install install codex --replace refused with AB7004 and every other Codex plugin operation was blocked until codex plugin marketplace remove audiobook-curator-marketplace was run by hand.

Expected: a dev install into Codex (dev proxy / --install-host codex / the host-adoption tests) must not leave a marketplace registration pointing at a temp directory. Either unregister on dev-server exit (and on test teardown), register the marketplace at a stable per-plugin path outside /tmp, or have doctor detect and offer to remove dangling Agent Bundle-created registrations (receipt-tracked). Test: run the Codex host-adoption acceptance, kill the dev server, assert codex plugin list --json still succeeds.

Related: #640/#642/#647 receipts (the registration should be receipt-owned like state roots), cargo-hauler #135 needed the same manual removal once for artifact/codex.