test: isolate offline BYOK children from ambient proxies

[hetaoBackend]

Change

Fixes #171. Offline BYOK validation inherited lowercase proxy variables, allowing CLI proxy setup to replace the preloaded fetch mock and pollute the outbound-network audit even when local provider calls succeeded.

Share the eight-variable proxy isolation helper between smoke and BYOK children. Add ten BYOK regression cases for each uppercase/lowercase HTTP, HTTPS, ALL and NO_PROXY variable, no proxies, and both cases together. Each case runs the built CLI against the local provider, verifies the catalog fetch is handled by the offline mock, and checks that no outbound connection was attempted. The existing exec, resume, persistence and real-tool checks remain in place. Production proxy handling and the network-deny hook are unchanged.

Validation

• Before the fix on e3724a1: isolated HTTPS_PROXY=http://127.0.0.1:9 passed; isolated lowercase https_proxy failed with the reported network-attempt audit signature.
• pnpm test:byok: 11/11 passed; pnpm test:smoke: 15/15 passed.
• Both suites with all six proxy variables set to the synthetic unreachable proxy and both NO_PROXY variants set to *: 26/26 passed.
• git diff --check, pnpm check:source and pnpm check:tsconfig passed.
• Full pnpm verify on clean commit 4ddf0189849373cbda5872fabee2cba549d7e48d: all 14 gates passed.
• GitHub Source verification passed on Linux, macOS and Windows with Node 24.20.0. Downloaded reports confirm smoke and BYOK PASS on all three; CI tested synthetic merge commit 2c663fd2f4b63476813a1b77b9110d1dac214dd3 (parents: main e3724a1 and this head 4ddf018). Release audit and the verification aggregate also passed.
• Local platform: macOS arm64, Node 26.4.0, pnpm 9.12.0. NOT RUN locally: Linux, Windows, Node 24, live model/service calls or real proxy routing. These are offline harness checks, not live-service acceptance.

Publication and contribution checks

• I have permission to contribute these changes under the existing applicable licenses; no imported material or notice changes.
• No credentials, account data, real user content, internal source history or private review material is included.
• Reviewed the new test helper before regenerating release/public-source.json. Regression cases stay in the existing declared node:test gate; no new Vitest file or gate.
• No product behavior or documentation changes. Searched other users of the offline network preload; smoke and BYOK are the only fixture consumers.

Maintainer handoff

Publication scope or license changes: one public test helper; no license changes.

Shared-source port: not needed; this changes the public distribution's offline test harness only.