fix(cli): honour HTTP_PROXY/HTTPS_PROXY for outbound requests

Node's global fetch ignores the conventional proxy variables, so on a host
whose egress only leaves through an HTTP proxy every request the CLI makes
fails while curl and npm succeed. The first thing a new user hits is:

    binary download unreachable — agents still launch; traffic is NOT
    compressed or metered
    fix: caveman setup --install

which points back at the command that just failed, with nothing to suggest a
proxy is involved. The same blind spot affects the npm version check, login,
and every cloud call.

Node 24 can opt in with NODE_USE_ENV_PROXY=1 and 22 has it behind an
experimental warning, but it is off by default and a process cannot enable it
for itself after start-up, so the CLI has to implement the variables.

Add packages/cli/src/proxy-fetch.ts: resolve the proxy per target
(HTTPS_PROXY/HTTP_PROXY with ALL_PROXY fallback, lower case winning, NO_PROXY
with wildcard, suffix and port rules), then dispatch over node:http and
node:https — CONNECT tunnel for https so TLS still terminates at the target,
absolute-form for http. Redirects are followed with the proxy re-resolved per
hop, so a hop into a NO_PROXY host goes direct.

main() installs the wrapper before any request. It is skipped when nothing is
configured, and when NODE_USE_ENV_PROXY is set so a runtime that already
handles proxying is not proxied twice. No new dependencies.

Verified on a proxy-only host: setup --install reported the download as
unreachable before and installs all six binaries with checksums verified
after. Tests cover variable precedence, NO_PROXY matching, tunnelling,
bypass, redirects, bodies, abort, and the install guard.

Signed-off-by: Dylan Neve <dylanneve1@users.noreply.github.com>