fix(agent-server): share marketplace snapshot cache

[Epochex]

HUMAN:

---

AGENT:

Why

The skills marketplace path checked for marketplaces/default.json before manifest discovery. The current extensions repository publishes .plugin/marketplace.json, so a cold skills request could return an empty catalog while the plugins endpoint successfully loaded the same repository. The two endpoints also fetched and cached separate views.

Summary

• Add one manifest-first marketplace snapshot loader with explicit-path fallback.
• Cache only successful snapshots and serialize cold loads to avoid duplicate fetches.
• Derive skills and plugins from the same snapshot while computing installed state on every request.

Issue Number

Fixes #4665

How to Test

• uv run pytest tests/agent_server/test_marketplace_snapshot.py tests/agent_server/test_plugins_service.py tests/agent_server/test_skills_service.py -q — 56 passed.
• uv run pytest tests/agent_server/test_plugins_router.py tests/agent_server/test_skills_router.py -q — 51 passed.
• uv run pre-commit run --files openhands-agent-server/openhands/agent_server/marketplace_snapshot.py openhands-agent-server/openhands/agent_server/plugins_service.py openhands-agent-server/openhands/agent_server/skills_service.py tests/agent_server/test_marketplace_snapshot.py tests/agent_server/test_plugins_service.py tests/agent_server/test_skills_service.py — all hooks passed.

The filesystem-backed regressions cover the real .plugin/marketplace.json layout, explicit fallback, fetch and parse failure retries, plugin-over-skill precedence, plugin filtering, shared fetches, and fresh installation state.

Video/Screenshots

Not applicable; this is backend catalog loading.

Design Doc

Not applicable; the change consolidates two existing private caches without changing REST schemas.

Type

• Bug fix
• Feature
• Refactor
• Breaking change
• Docs / chore

Notes

The five-minute in-process TTL is unchanged. Failed fetches or parses are not cached, so the next request retries.