Re-land proxy-aware builds and version resolution, hardened

[lroolle]

Description

Re-land b6360a6 (proxy-aware version resolution + Docker build proxy forwarding), split out of #404, with the review gaps fixed.

Type

• Enhancement

Details

b6360a6 rode on #404, broke Basic Tests, and attracted all seven bot review comments. Split out. Gaps to fix before re-land:

• docker build never gets --add-host host.docker.internal:host-gateway; the localhost-proxy rewrite is dead on native Linux Engine (Docker Desktop/OrbStack resolve the name, Engine does not)
• rewrite is syntactic: ://127.0.0.1 misses http://user:pass@127.0.0.1:7890
• log_proxy_config prints raw proxy values (userinfo = credentials) into build logs; version-upgrade.sh echoes generated proxy args; make echoes recipes
• curl-based _npm_registry_latest drops npm view's soft-fail contract: a transient registry error aborts the version report under set -euo pipefail, making the warn-and-fallback branch dead code
• tests/version-upgrade.sh fake curl returns empty for everything while stale npm view fixtures sit unused: no upgrade detected, no builds run, sed on missing docker-build.log, exit 2 — the feat: add grok agent (official xAI Grok CLI) #404 CI red

Not a gap: Copilot's claim that unencoded scoped package names 404 on the registry dist-tags endpoint is false (tested live, both forms return 200).

Related Files

• Makefile
• scripts/version-upgrade.sh
• scripts/release-utils.sh
• scripts/update-version-pins.sh
• scripts/install-agent-tooling.sh
• tests/version-upgrade.sh

Test Plan

• tests/version-upgrade.sh green with realistic registry fixtures (dist-tags + packument time)
• outage fixture: empty/failing curl -> warning + fallback to current, no abort
• make -n shows host-gateway mapping alongside rewritten proxy args; userinfo URLs rewritten too
• no raw proxy credentials in build output