feat: enable the nddev-builder in the base config for default-on codex

[rldyourmnd]

Summary

install-builder now enables the nddev-builder marketplace and plugin in the managed config.toml base, so a plain codex launch loads the builder's 21 creator/checker skills by default — no --profile nddev-builder needed. Codex 0.134.0+ removed the default-profile selector, so the previous profile-only delivery could not be default-on.

Behavior

• The canonical builder block is appended to config.toml as a co-owned addition after the setup base (idempotent — never duplicated). Drift detection tolerates it while keeping the setup base intact.
• The isolated nddev-builder.config.toml profile is still written for explicit --profile selection (verified to coexist with the base-config enable without conflict).
• A setup apply/switch that rewrites config.toml to the pure base drops the enable while the cache and profile persist; install-builder then restores it idempotently without re-materializing the cache or invoking the official Codex plugin commands (new lightweight enable-only path with full transactional rollback).
• builder-status reports config_enabled; an installed-but-not-enabled target now reports incomplete.

Validation

• Hermetic builder lifecycle + marketplace tests updated; test_setup_switch_and_remove is now the durability regression proof (switch strips the enable → re-install restores it without invoking Codex).
• Strict runtime proof updated for the base-config enable.
• Module 0.3.6 → 0.3.7; builder plugin cache unchanged (stays 0.3.2). Contract surfaces and the harness profile updated to the default-on fields.

https://claude.ai/code/session_01Y29c9sJRhChvxDcUjab5Xo