feat(proxy): honor http_proxy/https_proxy environment variables

[hsablonniere]

Closes #1050

Context

On corporate networks where all outgoing traffic must go through an authenticating HTTP proxy, clever failed with ECONNREFUSED. Unlike curl, kubectl or s3cmd, Node's global fetch() ignores the http_proxy/https_proxy environment variables by default — so the CLI never used the proxy.

The reporter found a workaround (NODE_USE_ENV_PROXY=1), but that requires users to know a magic variable, only works on recent Node, and emits an experimental warning on some of the versions where it does. We can do better: behave like the other CLI tools and pick up the proxy automatically.

Proposal

Install an EnvHttpProxyAgent (from undici) as the global dispatcher at startup, so every request the CLI makes (API calls, update checks…) routes through the proxy:

• triggers on http_proxy / https_proxy (and the uppercase variants)
• honors no_proxy / NO_PROXY for exclusions
• supports authenticated proxies via http://user:password@host:port
• the dispatcher is only swapped when a proxy is actually configured → zero behavior change for users without a proxy

Done in src/initial-setup.js because it must run before the first fetch().

Design decisions

• undici dependency + setGlobalDispatcher rather than the native NODE_USE_ENV_PROXY=1: the native variable is read at boot only (can't be enabled from JS at runtime), is gated behind Node ≥ ~22.18, and prints an experimental warning. The undici route works at runtime on any supported Node, with no warning, and requires no action from the user.
• undici pinned to 7.24.4, the same major bundled inside Node 24 → the global-dispatcher symbol is shared with the built-in fetch.

Stacked on #1106 (upgrade to Node.js 24)

This PR is stacked on #1106: its base branch is feat/node-24, so the diff above shows only the proxy change. It has been rebased on top of the Node 24 bump.

undici@7.24.4 requires Node ≥ 20.18.1 and is the same major as the undici bundled in Node 24, so the global-dispatcher symbol is shared with the built-in fetch. Merge order: land #1106 first, then this one (GitHub will then retarget the base to master).

Out of scope

• system-git deploys: with that feature enabled, clever deploy delegates to the system git binary, which follows its own proxy configuration (git config http.proxy / its own reading of http_proxy). Not covered here, documented in the README.

[github-actions]

🔎 A preview has been automatically published!

If you created the alias to the preview script, you can run this command to download and install this preview:

clever-preview update feat-proxy-from-env

You can also run it from your local repository:

./scripts/preview.js update feat-proxy-from-env

OS	SHA256 checksum
🐧 linux	bf84055e4c1917350a7a8e2538f53db2a4cbf1332d52f0be52eb78bd89700c95
🍏 macos	89ea8f1c20679e20d2e5386bbef0cd5d39e308ae0204a44e69953ace0e5154b4

This preview will be deleted once this PR is closed.