test: isolate offline smoke children from ambient proxies

[hetaoBackend]

Change

Fixes #154. Offline smoke children inherited host proxy variables, allowing CLI proxy setup to replace the preloaded fetch mock and trigger the network-deny audit during catalog refresh.

Clear uppercase and lowercase HTTP_PROXY, HTTPS_PROXY, ALL_PROXY and NO_PROXY only in the smoke fixture's child environment. Add six real CLI regression cases with an unreachable synthetic proxy; each checks provider output and the locally handled catalog request. Production networking and the network-deny hook are unchanged.

Validation

• Reproduced the three reported smoke failures and all six proxy regression failures before the fix.
• pnpm test:smoke passed with proxy variables removed and with all six proxy variables set to http://127.0.0.1:9: 14 tests passed in each run.
• git diff --check, pnpm check:source and pnpm check:tsconfig passed.
• pnpm verify full profile passed all 14 gates on clean commit a1c48d37cc7b3fdf38a9c59cc2ac239c8842a655 (macOS arm64, Node 26.4.0, pnpm 9.12.0).
• NOT RUN locally: Linux, Windows, Node 24, live model/service calls and real proxy routing. These are offline harness checks, not live-service acceptance.

Publication and contribution checks

• I have permission to contribute these changes under the existing licenses applicable to the changed files/packages; no imported material or notice changes.
• No credentials, account data, real user content, internal source history or private review material is included.
• No added/removed source files or new Vitest files; inventory and suite declarations need no regeneration.
• No product behavior, capability or documentation changes; offline results are not described as live-service acceptance.

Maintainer handoff

Publication scope or license changes: none.

Shared-source port: not needed; this changes the public distribution's smoke harness only.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}