Make exact-ref marketplace updates reliable for existing installs

[CBEPX]

Summary

The documented Update flow says to re-run marketplace add with a new pinned ref, but the current Codex CLI rejects the operation when cbepx already exists at an older ref.

Reproduction

Starting state:

• marketplace source: https://github.com/CBEPX/cc-plugin-codex.git
• pinned ref: v1.7.2
• installed plugin: cc@cbepx 1.7.2

Both of these fail while attempting to move to v1.7.3:

codex plugin marketplace add CBEPX/cc-plugin-codex --ref v1.7.3 --json
codex plugin marketplace add https://github.com/CBEPX/cc-plugin-codex.git --ref v1.7.3 --json

Observed error:

marketplace cbepx is already added from a different source; remove it before adding this source

Confirmed workaround

codex plugin remove cc@cbepx --json
codex plugin marketplace remove cbepx --json
codex plugin marketplace add CBEPX/cc-plugin-codex --ref v1.7.3 --json
codex plugin add cc@cbepx --json

The resulting config, marketplace checkout, installed cache, and setup check all resolve to v1.7.3.

Expected follow-up

Decide whether to:

1. update README with the reliable replacement flow for pinned upgrades; or
2. teach the installer/update path to replace an existing same-repository marketplace ref safely.

This is not a v1.7.3 release blocker because the remove/re-add workaround is bounded and verified.

[CBEPX]

Design decision from the v1.7.3 live qualification

Independent Fable 5.1 and Codex gpt-5.6-sol analysis, followed by a separate Fable critique and Codex synthesis, converged on a docs-first fix for the next release:

1. Fully quit active Codex CLI/Desktop clients.
2. Run the reliable four-command exact-tag replacement already captured in this issue.
3. Start a fresh Codex session and run $cc:setup to refresh the stable launcher and hook trust.
4. Document rollback to the previous exact tag because the replacement sequence is not transactional.

Keep the installer fail-closed for now. Do not infer permission to remove a marketplace from the changed-source error, and do not wait for upstream: current marketplace upgrade refreshes the configured source but cannot accept a replacement ref.

Installer-managed replacement remains a possible later opt-in feature only after the fake app-server/E2E fixture reproduces the real changed-ref rejection and tests identity preflight, explicit consent, rollback, interruption, and plugin-data preservation. The existing installer idempotency test repeats the same source and does not cover this failure.

No repository changes were made during this design workflow; this comment records the proposed scope for resolving #35 in a subsequent release.