fix: use environment HTTP proxies for CDP connections

[TristanIsK]

Cloud agents with mandatory HTTP proxies can create browser sessions through reqwest, but CDP WebSocket actions fail with DNS errors because tungstenite connects directly. This change makes the shared CDP connection honor HTTP_PROXY, HTTPS_PROXY, ALL_PROXY and NO_PROXY using the existing hyper-util matcher, establishing HTTP CONNECT before the normal WebSocket/TLS handshake.

Proxy credentials are limited to CONNECT. TLS and hostname verification remain enabled; rejected proxies do not fall back to direct access. WebSocket redirects retain the original three-hop limit and rematch the environment proxy/NO_PROXY for every destination, including direct-to-proxy transitions. CONNECT headers and connection/handshake waits are bounded. This supports HTTP CONNECT proxies; HTTPS-to-proxy and SOCKS proxy schemes return explicit errors. CLI and both bootstrap scripts are prepared for version 1.2.1.

Validation on review-fix head 92e7c4b:

• Reproduced review #4046129512 with an offline loopback test: pre-fix code failed immediately on HTTP 302; the same scenario passes after the fix.
• 35 tests passed, one existing optional local Chromium test ignored. fmt and clippy -- -D warnings passed in a network-disabled Linux container.
• New regressions cover 302/307 redirects over proxy -> NO_PROXY direct -> proxy -> proxy, success at the third redirect, a shared three-hop cap for proxy/direct routes, and missing/invalid Location values.
• The loopback test helper explicitly restores blocking mode on accepted sockets for Windows compatibility.
• All four current-head CI checks passed (run 35338541024): test, linux-release, windows-bootstrap and windows-release, including the Windows regression tests and standalone executable checks. The previous cloud acceptance below applies to its explicitly identified earlier commit, not this new binary.

Earlier cloud/source validation on af092b0:

• 32 Rust tests passed; one existing optional local Chromium test ignored. Five proxy regression tests cover remote target DNS, credentials isolation, environment selection/NO_PROXY, refusal without fallback, and malformed/oversized responses.
• cargo fmt and clippy -- -D warnings passed. Static Linux x86_64-musl release built successfully.
• All four CI jobs passed: test, linux-release, windows-bootstrap, windows-release (run 35336433854).
• Actual ChatGPT Work cloud sandbox, using the source-built 1.2.1 binary through the LexMount plugin wrapper: version, doctor, session creation, navigation to example.com, snapshot, title, screenshot and finally-close all exited 0. Title was Example Domain. No proxy/TLS changes or alternate browser/client were used for acceptance.
• Actual 1920x1080 screenshot downloaded and independently inspected; 20,376 bytes, SHA-256 71d7153d3ef40941e3ec5224326838289e825ff106566dcf866bbf6a7de14f1c. Binary SHA-256 6a55228f4f08bfdd0abcfcc1e01db96e8604b6d8adbbb979c951ae3f0c162812.

Release dependency: this is a source candidate, not a published CLI artifact. The plugin 1.1.19 draft pins CLI 1.2.1 and must be submitted only after the official CLI 1.2.1 release assets are available. No PR merge or release was performed.